Predictive thermal protection for motors in barrier operator systems

ABSTRACT

Disclosed are alternate embodiments of various components of a barrier operator system. and methods of operation, including of the mechanical drive subsystem with segmented and self-locking rail unit, rail mounting supports, belt and chain drive tensioning, and drive assembly carriage and interface; the electronics and software routines for controlled operation of the various barrier operator functions; wall console communications with the barrier operator; encryption and decryption of access codes; establishment and monitoring of travel limits and barrier speed and force profiles; thermal protection of barrier operator drive motors; and establishment and control of communications from the barrier operator to accessories by way of a wireless adapter.

PRIORITY CLAIM

This application claims priority from U.S. Provisional Application Ser.No. 61/519,579, filed on May 24, 2011, which is hereby incorporatedherein by reference in its entirety.

TECHNICAL FIELD

The present invention relates generally to remotely controlled barrieroperator systems for opening and closing garage doors, gates, and otherbarriers, and relates in particular to thermal protection of the motorsdriving the barriers.

BACKGROUND

Systems for controlling the movement of barriers, such as upward actingsectional or single panel garage doors, rollup doors, gates, and othertypes of motor operated barriers, utilize remotely controlled barrieroperators for effecting the requisite control. The remote control of thebarrier operator is typically provided by user-actuation of interior orexterior building mounted consoles, in wired or wireless communicationwith the barrier operator, as well as by remotely located hand held orvehicle mounted wireless transmitters, transmitting barrier movementcommands, typically access code encrypted, to the barrier operator. Amicroprocessor or microcontroller based controller unit associated withthe barrier operator receives and decrypts these encrypted commands, andbased thereon, instructs an associated motor to respectively open,close, halt the travel of, or otherwise move, the barrier in accordancewith the transmitted commands.

The wireless transmissions are typically in the form of radio frequency(RF) transmitted data packets, the data packets thereafter received byan appropriately tuned RF receiver associated with the barrier operator,where they are then decoded and processed by the barrier operatorcontroller. A typical RF communication protocol now in use by theindustry adopts code-hopping encryption of the access codes, sometimesreferred to as “rolling codes”, to prevent capture of the access codesby those not authorized to control the barrier operator.

Various drive assemblies are used to move the garage door or otherbarrier in accordance with the instructed operation. For example, it istypical in garage door installations for an AC or DC motor toreciprocatingly drive a coupled screw, belt or chain to correspondinglymove a carriage interconnected with the garage door back and forth alonga building mounted rail, thereby moving the door in the respectivelyinstructed direction. The barrier operator, directing the motor shaft toturn in one direction or the other, thus causes the door to be moved bythe drive assembly along a pair of oppositely disposed curved tracksbetween a fully vertical (closed) position and a fully horizontal (open)position. A large compression spring, along with associated pulleys andtrained cables connected to the door, provide assistance to the dooropening and closing operations.

Various techniques are also known to those of ordinary skill in the artfor electronically setting the open and close travel limits of thecarriage as well as electronically establishing the force sensitivitylimits. The electronically set force sensitivity limits determine theupper limits of the force to which the door can be subjected as ittravels along its path before there is an indication of an obstruction.Exceeding these limits then typically results in either the stoppage, orthe stoppage and reversal, of the motor (and thus the door travel),respectively depending upon the door's then existing direction oftravel.

While the past years have witnessed increased sophistication in thedesign and operation of these barrier operator systems, the presentsystems are not entirely satisfactory for all conditions of service.Consequently, it is the principal object of the herein describedinventions to provide such improvements and additions to existingbarrier operator systems, particularly in the area of a new and improvedmechanical drive sub-system as well as to the electronics and softwarecontrols thereof, so as to provide improved operating characteristics ofthe resulting systems.

SUMMARY

For example, significant improvement to the mechanical drive sub-systemof the barrier system of the present invention includes, inter alia, auniquely segmented and self locking rail upon which the carriagetravels, improved rail mounting, modified drive screw supports, moreefficient tensioning of the belt and chain drives, and a new andimproved redesign of the drive assembly's carriage and its interactionwith other components of the drive assembly.

Significant improvements to the electronics and software controlthroughout the barrier operator system have been made. For example, theremotely positioned wall console in the interior of the garage has aplurality of buttons or other user-operated control mechanisms forrespectively initiating different operations of the barrier operator,the respective operations differentiated by signals of respectivelydifferent frequencies. Moreover, wireless transmissions, whether fromhand-held or vehicle mounted transmitters or from wall mounted consoles,use uniquely different encryption protocols or methodologies, but areuniquely able to be processed by the same barrier operator. The barrieroperator controller also comprises multiple microprocessors serving asmutual safety checks on the other, as well as attending to theirrespectively different assigned functions.

The establishment of the force sensitivity limits in the barrieroperator system of the present invention is carried out by the creationof unique force sensitivity threshold profiles using offsets ofincreased value in the form of a stepped configuration. These profilesare generated during the “learn” mode of the operator, and when the dooris moved between its “open” and “close” position. Provision is made forthe user to increase or decrease, within a limited range, the forcesensitivity threshold levels. The force sensitivity threshold profilesare then used during the “operate” mode of the barrier operator todetect obstructions.

For barrier operator system versions utilizing a DC motor, thermalprotection of the DC motor is carried out without the use of a thermalsensor by the use of a unique algorithm that correlates motortemperature as a function of multiple factors, including motor load andrunning time of the motor. A novel arrangement is also provided toenable user selection between “good”, “better”, “best” speed profiles.

BRIEF DESCRIPTION OF THE DRAWINGS

Additional features of the invention, as well as more details thereof,and the overall improved barrier operator system of the presentinvention, will become readily apparent from a review of the followingdetailed description, taken in connection with the appended drawings, inwhich:

FIG. 1 is a broad perspective view of a garage door installation,illustrating the major components of a barrier operator system formoving the garage door;

FIGS. 2 a-1 through 2 a-3 are exploded views of the barrier operatormechanical drive sub-system shown in FIG. 1, in which a rail assemblyand a drive assembly chain drive are employed to advantage, andconstructed in accordance with the principles of the present invention;

FIGS. 3 a through 3 d are illustrations of a bottom side of a drivemount and a return pulley disposed within the rail assembly depicted inFIGS. 2 a-1 through 2 a-3, and constructed in accordance with theprinciples of the present invention;

FIGS. 4 a and 4 b are illustrations of a tensioning system of thebarrier operator drive assembly of FIG. 1, constructed in accordancewith the principles of the present invention;

FIG. 5 is an illustration of the carriage assembly shown in FIG. 1,constructed in accordance with the principles of the present invention.

FIG. 6 is an illustration of a self-aligning bullet entering thecarriage assembly of FIG. 5;

FIGS. 7 a-7 d are illustrations of respectively different portions ofthe self aligning bullet depicted in FIG. 6;

FIGS. 8 a and 8 b are illustrations of a connector member for the railassembly depicted in FIG. 1 and constructed in accordance with theprinciples of the present invention;

FIG. 8 c is an illustration of a coupler member for coupling anextension member to the rail assembly of the barrier operator drivesub-system shown in FIG. 1;

FIGS. 9 a and 9 b are illustrations of a portion of the rail of thebarrier operator drive assembly shown in FIG. 1, in which a screw driveis employed to advantage, and constructed in accordance with theprinciples of the present invention;

FIG. 10 is a schematic block diagram of a preferred embodiment of thecontroller unit of the barrier operator system depicted in FIG. 1, inaccordance with the principles of the present invention;

FIG. 11 is a software flow diagram of a method of operation of the mainmicrocontroller of the controller unit of FIG. 10;

FIG. 12 is a software flow diagram of a method of operation of thesecondary microcontroller of the controller unit of FIG. 10,illustrating a main loop and KEELOQ® interrupt;

FIG. 13 is a flow diagram illustrating an initialization process carriedout by the secondary microcontroller of the controller unit of FIG. 10;

FIGS. 14 a and 14 b are flow diagrams illustrating a mastersynchronization process carried out by the secondary microcontroller ofthe controller unit of FIG. 10;

FIG. 15 is a flow diagram illustrating an expansion bus link taskcarried out by the secondary microcontroller of the controller unit ofFIG. 10;

FIGS. 16 a and 16 b are flow diagrams illustrating an expansion busrequest handling process carried out by the secondary microcontroller ofthe controller unit of FIG. 10.

FIGS. 17 a and 17 b are flow diagrams illustrating a motor safety taskcarried out by the secondary microcontroller of the controller unit ofFIG. 10.

FIG. 18 is a flow diagram illustrating a ROM and RAM verificationprocess carried out by the secondary microcontroller of the controllerunit of FIG. 10.

FIGS. 19 a and 19 b are flow diagrams illustrating an operator userinterface task carried out by the secondary microcontroller of thecontroller unit of FIG. 10.

FIG. 20 is a flow diagram illustrating a limits setting procedurecarried out by the secondary microcontroller of the controller unit ofFIG. 10.

FIG. 21 is a flow diagram illustrating a light/alarm task carried out bythe secondary microcontroller of the controller unit of FIG. 10;

FIG. 22 is a perspective view of an optical wheel utilized to trackposition of the barrier controlled by the barrier operator system ofFIG. 1.

FIG. 23 is a graphical representation of the barrier travel limitsemployed in the barrier operator system of FIG. 1.

FIG. 24 is a graphical representation of the force sensitivity limitsprofile employed in the barrier operator system of FIG. 1; and

FIG. 25 is a flow diagram illustrating a novel method of encryption foruse in the remotely controlled barrier operator system of FIG. 1.

In the following detailed description, like elements are markedthroughout the specification and drawings with the same referencenumerals, respectively. The drawing figures are not necessarily to scaleand certain elements are shown in generalized or schematic form in theinterest of clarity and conciseness. It should be understood that theembodiments of the disclosure herein described are merely illustrativeof the principles of the invention.

DETAILED DESCRIPTION

Referring initially to FIG. 1, there is illustrated a garage doorinstallation including a barrier operator system 1 for moving a barrier,which in this example is an upward acting sectional garage door 10. Thedoor is movable along opposed sets of guide tracks 14 and 16 between alowermost closed position, as shown, covering an opening in a wall 12,and an upwardmost open position, in which the door 10 would be parallelto the floor 18. In its closed position, the door 10 would typically bein sealing engagement with the floor 18 or at least in close proximityto such surface. Barrier operator 20 is disposed within a housing orhead unit 26 and includes (i) an antenna and RF receiver unit (notshown) for receiving wireless transmissions and a (ii) microcontrollerbased controller unit 30 for, among other functions, processing theincoming wired and wireless transmitted door commands, and generatingmotor control signals corresponding to such commands to a DC or AC motor28. As subsequently described in greater detail, and in accordance witha feature of the present invention, the controller unit 30 preferablycomprises multiple microcontrollers under respective software control.

Specifically encrypted RF transmissions emanate from hand held (orvehicle mounted) transmitters 53 representing door commands to thebarrier operator 20. Commands can also be transmitted from an interiorwall mounted console 32, and/or an exterior wall mounted keyless entryconsole (not shown). The barrier operator 20 may be similar, forexample, to that described in U.S. Pat. No. 6,118,243, issued Sep. 12,2000 to Reed et al., assigned to the assignee of the present inventionand incorporated herein by reference for all purposes, but having thehereinafter described additions, modifications and features.

The barrier operator system 1 additionally includes a mechanical drivesub-system 2, the novel details of which are subsequently described, andgenerally comprises as its major components, (i) an elongated beam orrail assembly 22 connected at one end 86 to wall 12 and at its oppositeend 76 to the barrier operator head unit or housing 26; (ii) a driveassembly 5, which can be a reciprocatingly driven drive belt or chain ora rotatably driven screw drive, supported by the rail assembly 22, and(iii) a carriage 50 operably connected to the drive assembly 5. Thecarriage 50 is disconnectably engageable with an arm 24 which, in turn,is firmly connected to the door 10. Accordingly, motor 28, under controlof the barrier operator 20, drives the belt, chain or rotatable screw inone direction or the other, consequently transporting the carriage 50 torespectively raise (open) or lower (close) the door 10. A compressionspring and trained cables assembly (not shown) is connected with thedoor so as to aid the opening and closing of the garage door, in themanner well known to those of ordinary skill in the art.

The wall console 32 is supported on one of the internal sidewalls 34 andenables communication with the barrier operator 20 to provideuser-instituted instructions to the controller 30. These instructionsare initiated by the depression of different buttons on the consoleinitiating signal communications to the barrier operator 20 respectivelyrepresenting, for example, door movement commands, worklightinstructions, and vacation lock mode (set or release). Additionaldetails regarding this operation are subsequently described. The signalcommunications from console 32 are transmitted to the barrier operatoreither by way of hardwire conductor means 36, as shown, or alternativelyby wireless communication. In similar manner, a keyless entry console(not shown) is in wired or wireless communication with the barrieroperator 20 and similarly enables user-instructed instructions to thecontroller 30.

The barrier operator system 1 illustrated in FIG. 1 may also include oneor more types of external entrapment devices, well known to those ofordinary skill in the art, for detecting and effecting a response toobstructions that may be encountered by the door 10 as it is beingclosed. A first type of such device is disclosed as an elongated sensorstrip 38 that is mounted on the lower edge of the door 10 and isoperable, upon engagement with an obstruction in the doorway, totransmit a signal to the controller 30 to halt the downward movement ofthe door, typically followed by its return to the open position. Asecond type of external entrapment device may be an optical assembly 39comprising an optical beam transmitter 40, typically of the infraredtype, disposed on one side of the doorway opening, and a receiver 42disposed on the opposite side of such opening and positioned to receivethe beam 46 from the transmitter 40. This assembly, often referred to asa safety beam or STB, is operable to transmit a signal to the controller30 to halt the downward movement of the door whenever an obstruction inthe doorway opening interrupts the beam 46, and is illustrated in FIG.10 as item 1030. Either one, or both, of these external entrapmentdevices may be used with an internal entrapment approach which is basedupon the sensing of a change in motor operation characteristics (e.g.,increased torque) due to the engagement of an obstruction, the detailsof which are subsequently described.

Barrier Operator Mechanical Drive Sub-System

Referring to FIGS. 2 a-1 through 9 b, there is now described preferredembodiments of new and improved versions of the barrier operatormechanical drive sub-system 2 constructed and operating in accordancewith the principles of the present invention. Accordingly, elongatedrail assembly 22 is configured to receive a belt or chain drive assembly5 (for exemplary purposes, shown in the drawings as a chain drive 66 inthe initial views of FIG. 2 a-1 through FIG. 5). Specifically, and asseen in FIG. 2 a-1, the elongate rail assembly 22 has a top wall 54, apair of sidewalls 56 and 58, extending wall portions 60 opposite topwall 54, and a channel 62 formed to receive the drive mechanism 5. Wallportions 60 define a longitudinal slot 64 disposed along the length ofrail assembly 22 forming an opening to provide insertion of, and accessto, the barrier operator drive assembly 5, and enables the arm 24(FIG. 1) to extend through the rail 22 for connection to door 10.

Referring specifically to FIGS. 2 a-1 through 2 a-3, the barrieroperator drive system 2 further includes the carriage 50, a drivesprocket 70, a return pulley 72, and an endless drive chain 66 havingends 66 a and 66 b connected via a bullet member 68 (FIGS. 2 a-2 and 7a-7 d) to enable the endless drive chain 66 to be wrapped and/orotherwise trained around drive sprocket 70 on one end and return pulley72 on the other end. In operation, and as subsequently described in moredetail, motor 28 turns sprocket 70, which in turn causes movement ofcarriage 50, and thus movement of door 10. As previously mentioned,while the drive assembly 5 is illustrated in FIGS. 2 a-1 through 2 a-3as an endless chain 66, it should be understood that as an endlessdrive, it can alternatively comprise other items, for example a belt.

Referring to FIGS. 2 a-1, 3 a and 3 b, a drive mount member 74 isillustrated mounted within channel 62 at rail end 76 to rotatablysupport drive sprocket 70. Drive sprocket 70 includes a centralizedopening 80 shaped to receive the output drive shaft (not illustrated)from motor 28 (FIG. 1) so that the rotation of the output drive shaftcorrespondingly rotates the drive sprocket 70 for reciprocal translationof the chain 66. Preferably, drive mount member 74 is secured withinchannel 62 via bolts 74 a (FIG. 3 b), which extend through rail top wall54 and into corresponding openings (not illustrated) disposed on drivemount member 74.

In the embodiment depicted in FIGS. 3 a-3 d, a bullet stop 78 isintegrally formed with mount 74 and includes a slot 78 a large enough toenable chain drive element 66 to fit therein while small enough toprevent entry of bullet 68 (FIGS. 3 a & 3 b). Similarly, a stop 79 iscoupled to rail 22 (FIG. 3 c) and disposed adjacent to return pulley 72and includes slots 79 b which are large enough to permit endless chaindrive 66 to fit therein while small enough to prevent entry of bullet68. Preferably, stop 79 is disposed within channel 62 and secured tosidewalls 56 and 58 via a pair of screws (see FIG. 8 c illustratingscrew 22 c). In particular, each screw is inserted through an opening oneach respective sidewall 56 and 58 and into respective openings 79 c(FIG. 3 c) on each side of stop 79 to prevent movement of stop 79relative to elongate rail 22. Thus, as bullet 68 moves within channel62, stop members 78 and 79 function to prevent over-travel of carriage50 and/or bullet 68 (i.e., crashing into sprocket 70 and/or returnpulley 72) and thus avoid potentially damaging portions of the barrieroperator drive assembly.

Referring specifically to FIGS. 3 b and 3 d, drive mount 74 is disposedwithin channel 62 such that the outer diameter of drive sprocket 70 isdisposed near a rail tab 82. Rail tab 82 is spaced apart from drivesprocket 70 a distance slightly larger than the thickness of endlesschain drive 66 so as to enable unimpeded movement of chain 66 while alsopreventing separation of the chain 66 from the drive sprocket 70 in theevent of loss of tension on drive element 66.

As illustrated in FIGS. 3 b and 3 d, rail tab 82 is inserted through arail opening 54 a and extends from a dual purpose bracket member 83,which is also used to secure rail assembly 22 to operator housing orhead 26 (as best seen in FIG. 3 b). In the embodiment illustrated inFIG. 3 b, dual purpose bracket member 83 is formed to overlay railassembly 22 and attach directly to operator housing or head 26.Alternatively, rail tab 82 can be formed integral with rail 22 such thattab 82 extends perpendicularly from top wall 54 into channel 62.

Referring now to FIGS. 4 a and 4 b, a tensioning system 84 isillustrated for adjusting the tension of endless drive element 66 whensuch element is trained around drive sprocket 70 and return pulley 72.Tensioning system 84 is disposed within channel 62 and accessiblethrough slot 64. In addition, an opening 63 disposed on rail sidewall 56enables access to drive element 66 and return pulley 72. It should beunderstood that opening 63 can be of any length suitable to facilitateaccess to drive element 66 and return pulley 72 to facilitateinstallation and maintenance thereof. In the illustrated embodiment,tensioning system 84 includes an end bracket 88 having hooks 90 and 92sized to receive and otherwise engage rail sidewalls 56 and 58 at therail end 86. As illustrated particularly in FIG. 4 b, end bracket 88 isgenerally “V” shaped having a base section 94 and legs 96 and 98angularly extending from base member 94 such that hooks 90 and 92 canreceive sidewalls 56 and 58 therein. As best seen in FIG. 4 a, endbracket 88 is sized to have a height “H” generally corresponding to theheight of rail 22 so as to prevent relative vertical movement betweenend bracket 88 and rail 22 in the direction indicated by arrows 95.

Continuing reference to FIGS. 4 a & 4 b, tension on endless driveelement 66 is adjusted by a tensioning screw 102, which secures a pulleysupport member 104 and thus return pulley 72, to base member 94.Tensioning screw 102 extends from support member 104 and through basemember 94 and is of a sufficient length to receive a spacer/dampener106, a washer 108 and a nut 110 to adjustably secure pulley support 104to end bracket 88. In particular, tensioning screw 102 includes a firstend 112 having a head 114 and a threaded second end 116 configured tothreadingly engage bolt 110. As illustrated in FIGS. 4 a and 4 b, spacer106 and washer 108 are disposed on screw 102 between base member 94 andbolt 110. When adjusting the tension of chain drive 66, bolt 110 isrotatable to travel along threaded end 116 to increase or decrease thedistance between base member 94 and pulley support 104. For example,when increasing the tension on the chain 66, bolt 110 is positionedalong screw 102 so as to cause the distance “D” (FIG. 4 a) between basemember 94 and pulley support 104 to decrease. Similarly, when decreasingthe tension on drive element 66, the bolt 110 is rotatably positionedalong screw 102 in the opposite direction to cause the distance “D”between base member 94 and pulley support 104 to increase.

Referring to FIGS. 2 a-3, 4 a and 4 b, when installing tensioning system84, return pulley 72 is inserted within channel 62 to enable endlessdrive element 66 to be trained therearound. Return pulley 72 is mountedwithin pulley support member 104, both being aligned such that a centralopening in each of the return pulley 72 and support member 104 arealigned with a service opening 54 a that is formed on top wall 54.Opening 54 a is sized to receive a pin 73 therethrough to secure pulley72 on support member 104. Once inserted therein, pulley support member104 is pulled in the direction of arrow 75 to increase the tension onendless drive element 66. End bracket 88 is disposed on the end of rail22 to enable tensioning screw 102 is inserted through base section 94for adjusting the tension of tensioning system 84, as previouslydescribed.

In order to move door 10 between the open and closed positions, drivemotor 28 is operable to move endless chain drive 66, which positionscarriage 50 between first and second ends 76 and 86. Referring to FIGS.5 and 6, carriage 50 includes a body portion 118 preferably formed ofupper and lower members 118 a and 118 b and having a slot 120 formedtherein to pivotally receive an end of arm 24, which is pivotablyconnected to door 10 at the opposite end of arm 24 (FIG. 1). Bodyportion 118 includes a front surface 122, a rear surface 124, a pair ofside surfaces 126 and 128, and top and bottom surfaces 130 and 132, allsized such that body 118 is slideably disposed within channel 62. Body118 includes longitudinal slots 134 and 136 extending between frontsurface 122 and rear surface 124, both having a cross sectional areasized slightly larger than the diameter of bullet 68 to enable bullet 68(and thus drive chain 66) to travel inside slots 134 and/or 136. Asexplained in further detail below, carriage 50 contains a lockingmechanism 152 (FIG. 6) positionable between a locked position and anunlocked position in response to pulling forces exerted on pull cord 153(FIG. 5) so as to secure bullet 68 within carriage 50. In this position,as bullet 68 is moved via drive element 66, carriage 50 moves alongtherewith.

Referring specifically to FIGS. 6 and 7 a-7 d, bullet 68 is formed of agenerally circular cross section corresponding generally to the crosssectional area of longitudinal slots 134 and 136. Bullet 68 containsfirst and second sections 68 a and 68 b that are coupled together tosandwich each respective end 66 a and 66 b of drive chain 66 (FIG. 2a-2). Referring specifically to FIGS. 7 a and 7 b, sections 68 a and 68b contain engagement grooves or recesses 138 to receive and securerespective ends 66 a and 66 b (FIG. 2A-2) of endless drive element 66.Section 68 b includes a recessed portion 140 to cooperatively receiveextension 142 on section 68 a to facilitate alignment of sections 68 aand 68 b when assembling bullet 68. A plurality of fasteners 144 (FIG. 7c) are configured to secure sections 68 a and 68 b together. Inoperation, fasteners 144 and the cooperative engagement of recess 140with extension 142 act to resist longitudinal forces generated bymovement of drive element 66.

Referring specifically to FIGS. 6, 7 c and 7 d, bullet 68 is configuredto self-align with longitudinal slot 134 or 136 in response to bullet 68entering carriage 50. In operation, sloped surfaces 146 along withextensions 148, which extend outward from bullet 68, are all configuredto axially and rotationally align bullet 68 relative to longitudinalslots 134/136 in response to bullet approaching and entering carriage50. For example, as bullet 68 approaches longitudinal slots 134/136,surface 146 slideably engages end surface 122 of carriage 50 toco-axially align an axis of bullet 68 with an axis of longitudinal slot136. As bullet 68 enters longitudinal slot 136, extensions 148 alignwith and extend within a sidewall slot 136 a via contact with endsurface 122 to orient and/or otherwise rotate bullet 68 such that arecess 150 on bullet 68 is inwardly positioned to receive locking bar152. Locking bar 152, when disposed within recess 150, prevents relativemovement between carriage 50 and bullet 68 such that when drive motor 28turns, drive mechanism 5 moves bullet 68 and thus carriage 50.

Rail assembly 22 can be formed as a single continuous portion, or inaccordance with a feature of this invention, an assembly formed ofmultiple segmented portions that are secured together. For example,referring specifically to FIGS. 8 a and 8 b, rail 22 contains twosegments 154 and 156 secured together, as explained in further detailbelow, via connector section 160 to enable rail assembly 22 to be storedand/or otherwise shipped in a disassembled and compact fashion whilealso being easily assembled on-site. It should be understood, however,that while rail assembly 22 is shown as two segments, it can also beformed of a greater number of sections. For example, it can be formed ofthree segments respectively secured together via two connector sections160.

As described, the elongate rail segments 154 and 156 can be assembledwithout the use of tools by using a snap-fit connection via railconnecting sections 160. Connecting sections 160 comprise a top wall 160a, a bottom wall 160 b having a slot 64, and a pair of sidewalls 160 cand 160 d forming a channel to receive segments 154 and 156. Forexample, referring specifically to FIGS. 8 a and 8 b, each railconnector 160 contains a rail engaging tab 162, which is biased to fitwithin a corresponding opening 164 on rail section 154. When connectingsections 154 and 156 of elongate rail 22, sections 154 and 156 areinserted into respective ends of rail connecting section 160 untilengaging tabs 162, which are inwardly biased, and snap or are otherwisedisposed within respective openings 164 on sections 154 and 156. When inthis position, connector section 160 prevents separation of sections 154and 156. When disassembling sections 154 and 156 of elongate rail 22,access to engaging tab 162 through slot 64 enables a force to be appliedto engaging tab 162 to lift and remove each tab 162 from eachcorresponding opening 164. Once removed, rail sections 154 and 156 canbe separated from rail connector 160.

While the embodiment illustrated in FIGS. 8 a and 8 b utilizes aflexible engaging tab 162 for securing rail sections 154 and 156together, it should be understood that engaging tabs 162 may beotherwise configured. For example, in lieu of tabs 162 and respectiveopenings 164, connector section 160 may include detents engageable withcorresponding recessed portions disposed on rail sections 154 and/or 156to maintain frictional contact between the members. In addition, itshould be understood that rail sections 154 and/or 156 can be configuredwith engaging tabs 162 and corresponding openings 164 without the needfor connecting sections 160. Alternatively, sections 154 and 156 can besecured together via a friction fit.

Referring specifically to FIG. 8 c, elongate rail 22 may be extended viaa rail extension section 22 a, which is connected to rail 22 via acoupler member 22 b. Preferably, rail extension 22 a extends a length ofapproximately 12 inches and abuts rail end 86 so that the overall lengthof elongate rail 22 is extended by the length of coupler member 22 b.When securing rail extension 22 a, coupler member 22 b is positioned tooverlay a portion of rail end 86. Rail extension 22 a is inserted insidethe opposite end of coupler member 22 b so that coupler member 22 b isable to resist relative lateral movement (i.e., movement in anydirection other than along the longitudinal axis of rail 22) betweenrail 22 and extension 22 a. Once rail extension 22 a is positioned andtensioning system 84 has been inserted and properly tensioned therein toset the proper tension for endless drive element 66 (previouslydescribed), the tensioned drive element 66 prevents axial separationbetween rail extension 22 a and rail 22. As an added protection toresist axial separation between extension 22 a and rail 22, screws 22 c(screw 22 c on wall 56 not illustrated), which as previously describedare utilized to secure stop 79 within channel 62, can be insertedthrough openings 22 d in coupler member 22 b. Thus, the screws 22 c areoperable to perform a dual function: (i) in the event there is a forceon the system that could cause axial separation between extension 22 aand rail 22, the screws 22 c will prevent separation between thecomponents and (ii) secure stop 79 within channel 62.

Referring to FIGS. 9 a and 9 b, the drive assembly 5 is a screw drivedisposed within elongate rail assembly 22. In operation, drive motor 28(FIG. 1) rotates a screw member 202 which, in turn, causes carriage 50to travel within channel 62. In FIG. 9 a, screw 202 is supported withinrail assembly 22 via a plurality of spaced apart screw support members204, which contain a centralized slot 206 to receive and support screw202 therein.

According to the embodiments disclosed herein, screw support members 204are fixedly secured within channel 62 without the use of tools or otherfastening mechanisms. For example, screw supports 204 include a pair ofextensions 208 and 210 sized to frictionally fit into correspondingopenings 218 and 220 formed in top wall 54 of rail assembly 22. Inparticular, top planar portions 208U and 210U of extensions 208 and 210are aligned with and inserted through openings 212 and 214 so as to bepositioned above top surface 54. Once inserted therein, screw support204 is rotated in the direction of arrow 216 until lower post portions208L and 210L of support extensions 208 and 210 (i.e., the postssupporting the top planar portions of extensions 208 and 210 abovesupport 204) are disposed within and frictionally engage the sidewall ofsmaller openings 218 and 220. When in this configuration, the frictionalengagement of lower post portions 208L and 210L with openings 218 and220 and size of the top planar portions 208U and 210U, which are largerthan openings 218 and 220, prevent relative movement of support 204 withrespect to rail 22 and maintain alignment of slots 206 with thelongitudinal axis of rail assembly 22 so as to receive screw 202. Whendisassembling rail 22, screw supports 204 are manipulated in oppositefashion for removal from channel 62.

Screw support member 204 optionally includes a rubber dampener 230overlaying top surface 211 of screw support 204 to isolate screwsupports 204 from rail 22 to reduce vibration and ultimately, minimizevibrations and sounds resulting from vibrations during operation.Preferably, rubber dampener 230 is over molded with a soft rubber and isof a sufficient thickness to isolate dampener 230 from rail 22.Preferably, dampener 230 overlays the entire top surface 211 to separatescrew support member 204 from rail 22.

Referring back to FIGS. 1 and 2 a-1 through 2 a-3, top surface 54 ofelongate rail assembly 22 optionally includes clips 55 extendingtherefrom for securing wires, such as, for example, in the event it isdesired to extend wires 36 from barrier operator 20 toward wall 12 forconnection with optical beam transmitter 40 and receiver 42. Each clip55 includes upward extending and arched arms 55 a and 55 b andcantilevered portions 55 c and 55 d expending generally perpendicularlytherefrom to form an opening to receive one or more wires 36.

Barrier Operator System Electronic Controls

Multiple Microcontrollers and their Respective Software Controls

As previously described, the controller unit 30 is effective to carryout the various control operations of the barrier operator 20. While allof these operations may be performed by using a single microcontroller,in accordance with an advantageous feature of this invention, multiplemicrocontrollers are utilized to carry out respectively assignedfunctions, the required software appropriately divided among themicrocontrollers, with each microcontroller also serving as a safetycheck on the other to assure appropriate conditions before motor 28 canoperate.

Thus, and with initial reference to FIG. 10, the preferred embodiment ofthe controller unit 30 comprises two separate software controlledmicrocontrollers 1000 and 1002, both located in the head unit 26. Inthis embodiment, microcontroller 1000 is the main microcontroller andhas primary responsibility for control over the operation of the motor28, as well as particular safety features (e.g., thermal protection ofmotor 28), while microcontroller 1002 is the secondary microcontrollerand has primary responsibility for control over other assignedfunctions, such as processing the encrypted RF data input from receiver1066, controlling work light 1070, actuating and deactuating motiondetector 1068, and actuating alarm 1058 (activated, for example, by apanic button on a hand-held transmitter 53), as well as carrying outsuch additional safety features not attended to by main microcontroller1000. Moreover, and as a significant feature of this invention, themicroprocessors 1000 and 1002 act as watchdogs over one other topreclude motor operation in the event of, inter alia, a fault or otheroperation infirmity in one or the other.

Communications between the two microprocessors in the head unit can beaccomplished, in principal part, utilizing an I²C expansion bus 1004,for example. Accordingly, a master slave synchronous port (MSSP) 1006 ofthe main microcontroller 1000 can be used in I²C master mode to enablethe main microcontroller 1000 to communicate with the secondarymicrocontroller 1002. Similarly, the MSSP 1043 can be used to enable thesecondary microcontroller 1002 to communicate with the mainmicrocontroller 1000 along the I²C expansion bus 1004.

Moreover, the hardware and software of controller unit 30 are designedsuch that both the main microcontroller 1000 and secondarymicrocontroller 1002 must “agree” that there are no faults or otheradverse system conditions in operator 30 before the motor 28 mayoperate. In accordance with one exemplary embodiment for accomplishingthis objective, the main and secondary microcontrollers have respectivemotor enable output lines 1018 a and 1018 b connected as inputs to motorenable circuitry 1019. Motor enable circuitry 1019, which, for example,can be a main power relay or other switching element, is effective toenable operation of motor 28 only when there are signal inputs to motorenable circuitry 1019 at both outputs 1018 a and 1018 b. Thisrequirement allows for safety so that if one microcontroller senses afault, such as the secondary microcontroller determining that the mainmicrocontroller 1000 is locking up to continue the motor 28 closing thedoor when it should not do so, the secondary microprocessor candeactivate its motor enable output 1018 b and thereby halt motoroperation.

Alternate embodiments for carrying out this safety protection can beimplemented. For example, under control of the appropriate software,when the main microcontroller 1000 receives a command (e.g., from remotetransmitter 53 or wall console 32) to move the door, it sends out amessage to the secondary microcontroller on the I²C expansion bus 1004indicating that it is about to move the door. If the secondarymicrocontroller 1002 has no issue with this operation (e.g., detects nofaults), it confirms to the main microcontroller 1000 that it mayproceed. In that event, the main microcontroller 1000 performs itsactions, such as, for example, proceeding with pulse width modulation(“PWM”) control at 1010 in the case of a DC motor. The motor 28 willthen operate, moving the door to the instructed position. At any time,prior to or during the door movement, if either microcontrollerthereafter detects a fault, then that particular microcontroller canstop the motor. The secondary microcontroller 1002, for example, caninterrupt any signal output at 1018 a, thus deactivating the motorenable circuitry 1019. The main microcontroller 1000, for example, canalso deactivate the PWM circuitry 1010, thus similarly switching off themotor enable circuitry 1019. Additionally, the microcontrollers can beconfigured and programmed in such a way that either the mainmicrocontroller 1000, or the secondary microcontroller 1002, can preventoperation of the motor 28 in the event of excessive motor torque(referred to as “torque-out”).

In performing as an I²C slave, the secondary microcontroller 1002 canrequire that the primary microcontroller transmit a periodic message ata predetermined rate (e.g., every fifty milliseconds), indicating normaland no-fault operation. Then, if the secondary microcontroller 1002senses that the main microcontroller 1000 has ceased sending messages atthis rate, the secondary microcontroller 1002 can disable motor enablecircuitry 1019, which then results in cessation of operation of motor28.

In the main microcontroller 1000, the process 1100 (see program flowchart of FIG. 11) for sending the periodic message to the secondarymicrocontroller 1002 stores outgoing requests in a queue. A method isthen available for the task/process that sent the request to get theresponse. Since there may be several tasks attempting to send requestsat once, it may take a few cycles before a request is properly sent anda response read. Therefore, if sending a request, a state machine, forexample, is employed to wait for the response.

In communicating with the secondary microcontroller 1002, the mainmicrocontroller 1000, for example, opens a number of sockets andreserves one of those sockets for uninitiated requests, while theremaining sockets allow simultaneous requests from multiple tasks to besent at once. An outgoing queue and queue information can be maintained,for example, in a structure that contains one packet queue for eachtask. In this way, the main microcontroller 1000 can maintain status ofeach queue (e.g., whether it is empty or full) and each socket (e.g.,busy or free, transmitting or receiving, etc.). Accordingly, appropriatemethods can permit allocation of available queue buffers to tasks asneeded on a dynamic basis.

In accordance with a feature of the invention, if there is a problemwith communication, the process 1100 for periodically communicating withthe secondary microcontroller 1002 performs an event that causes themain microcontroller 1000 to halt execution. The secondarymicrocontroller 1002 can then notice that the main microcontroller 1000has stopped executing, and it can perform a reset of the mainmicrocontroller 1000. During this process, the secondary microcontroller1002 verifies that the main microcontroller 1000 has not reset too manytimes within a set period. In this case, the secondary microcontroller1002 can keep track of the number of resets. If too many resets haveoccurred in the set period, then it can assume that the device isbehaving improperly and, in response, halt the system operation. Inturn, the main microcontroller 1000 can verify with the secondarymicrocontroller 1002 that the A/D values are valid with a request forcurrent message.

Since, in this embodiment, the secondary microcontroller 1002 bearsprimary responsibility for interfacing with users via remote transmitterdevices 53, the secondary microcontroller 1002 can relay user commandsreceived from these devices 53 to the main microcontroller in the formof uninitiated packets. Thus, the main microcontroller 1000 can respondto uninitiated packets from the secondary microcontroller 1002 bysetting, clearing, or adjusting barrier travel limits, setting,clearing, or adjusting a barrier force profile (see FIG. 24), and/orsetting, clearing, or adjusting barrier movement speed settings.

When the uninitiated packet contains a command related to programmingtravel limits, the main microcontroller 1000 can respond appropriatelywhile observing certain predefined safety conditions. In particular, themain microcontroller 1000 can determine the motor idle state and/orcheck whether limits set are too close together. Thus, when a command isreceived to enter a process for initially programming travel limits,then when a limit set command is received, it can be ignored if themotor is not idle, and a message can be queued to the secondarymicrocontroller 1002 that the command was invalid. Upon receipt of afirst acceptable limit, the stored limits (FIG. 23) and force profiles(FIG. 24) can be cleared and this new limit position stored. Then, asecond limit set command can be ignored if the position indicated is tooclose to the first end of travel barrier position. In this case, amessage can be queued to the secondary microcontroller 1002 that thecommand was invalid. Otherwise, when a limit set command is receivedthat is acceptable, the open or close limit can be set at the currentdoor position, and a status message can be queued to the secondarymicrocontroller 1002 that the command was accepted. Once both limits areset, the distance between the limits can be compared to a predeterminedthreshold (e.g., six feet) to determine whether a sectional or one piecedoor is in use, and a variable for door type stored in the EEPROM 1016can be set accordingly.

In order to communicate at the proper rate, the main microcontroller1000 can call a process 1104 for communicating with the secondarymicrocontroller 1002 at the very beginning of its main loop 1100, whichis first entered following initialization at 1106, and which isthereafter iteratively reentered upon time expiring (e.g.fifty-milliseconds) at decision step 1102. When this process 1104 iscalled, the main microcontroller 1000 can either send the next queueddata packet or ask the secondary microcontroller 1002 for anun-initiated packet. Since the secondary microcontroller 1002 is usingthis request as a method of determining the freedom of faults of themain microcontroller 1000, this process 1104 can be called at a constantrate (e.g., every 50 ms). Placing the process 1104 at the beginning ofthe main loop 1100 ensures that it is not delayed by execution of otherprocesses in the loop 1100.

As previously described, preceding the process 1104, the initializationstep 1106 is performed. This initialization step 1106 can be performedeach time the main microcontroller 1000 is started up (e.g., reset). Thesecondary microcontroller 1002 also has an initialization step 1200 (seeFIG. 12), the details of which are described below with reference toFIG. 13. Together, the two initializations are carried out each time thebarrier operator is powered on to accomplish power on self-testactivities. For example, these activities can include testingcommunication between the main microcontroller 1000 and the secondarymicrocontroller 1002. Also, these activities can include an EEPROM CRCcheck, as well as reading the configuration bits out of EEPROM 1016 todetermine whether the barrier operator has a belt, chain or screw typedrive, or is of the “good”, “better”, “best” type. The reason for suchis subsequently described.

During this step 1106, a fault can be logged if either one of twowatchdog timers caused a reset. Additionally, a watchdog timer 1007(FIG. 10) maintained on board the main microcontroller 1000 can bestarted, and analog and digital I/O pins on the board can beinitialized, as can be on-chip items, such as the I²C expansion bus1004, timers 1008A-1008D, and PWM circuitry 1010 (e.g., CCP1 unitoperating in PWM mode at zero percent duty).

In accordance with this specific embodiment, timer 1008A is used tomeasure various events in the system. The timer is free running, neverreset, and the overflows counted. An eight times prescaler can be used;in this case, with the sixteen megahertz MCU clock, each timer incrementrepresenting two microseconds. As a result, a sixteen bit timer can beused to measure events up to one-hundred thirty milliseconds. Timer1008A can also be used to run a seconds counter in the main idle loop.It is additionally used to track the door speed by measuring the timebetween opto-coupler inputs. When timer 1008A overflows, an interruptcan be triggered that increments a sixteen bit overflow counter. Thisoverflow count, along with the sixteen bit timer value, provides athirty-two bit timer. This thirty-two bit timer can be used by onoptical wheel code to achieve wider timing capabilities during slowermovement.

Timer 1008B can be used by the PWM circuitry 1010 to drive a DC motor.The timer 1008B prescaler and period register operate together to setthe frequency of the pulse width modulation to ten kilohertz.Accordingly, there are no interrupts associated with timer 1008B. ThePWM circuitry 1010 can be controlled by a duty cycle having, forexample, ten bits of resolution.

Wall Console

Timer 1008C can be used in a counter mode to count pulses from the wallconsole 32. The wall console unit 32, being one of the units for thehomeowner to activate the opener, preferably has, in connection withappropriate software control, three buttons, a first user-actuatedbutton to open and close the barrier, a second user-actuated button toturn the lights on the head on and off, and a third button to place thesystem in, or release it from, vacation lock mode. This operation issubsequently described in greater detail. The software is also employedto activate the lights on the head when the door is commanded to move,and then automatically turns the light off a defined period (e.g., fourminutes) later. If the light button on the wall console 32 is pushed,then this button press can cause the lights to stay on until the lightbutton is again pushed.

The main microcontroller 1000 has the ability to turn the power to thewall console 32 on and off. It can also flash an LED on the console toindicate that the barrier operator is in vacation lockout mode. Thisflashing can be performed at a rate that allows for the console 32 tostill maintain power, yet provides an adequate indication of vacationlock mode. Once the unit is in vacation lock mode, and the LED on theconsole 32 is flashing, the door can move as always until the closelimit is reached. Once the close limit is reached, the door is preventedfrom moving until the homeowner presses the vacation lock button again,thereby releasing the barrier operator from vacation lock mode, allunder software control.

The buttons on the wall console 32 can all be debounced for a period oftime (for example, ninety-eight milliseconds) (see FIG. 11). That is, abutton should preferably be off for at least that long, and then on fora period of time, say sixty-five milliseconds, to be considered a validbutton press. One exception to this requirement can be the manualoverride function of the door button, in which it is held down until thedoor reaches the floor.

In accordance with a particular feature of the present invention,user-actuation of the different buttons on the wall console 32,respectively indicating different commands to the controller 30 ofoperator 20, transmits a series of electronic pulses, in which differentfrequencies of these pulses respectively represent these differentcommands. The controller 30, and more specifically main microcontroller1000, is effective to receive and process these pulses and perform theoperation respectively represented by the particular frequency of thereceived pulsed signals.

As examples, different button functions (commands) can be represented bythe frequencies set out hereinafter in TABLE 1:

TABLE 1 Freq. Button Function/Command 3.8 kHz ± 20% Vacation Lock Mode(set and release) 7.0 kHz ± 20% Light (on and off) 16.0 kHz ± 20%  Door(open and close)Of course, any other functions or commands may be similarly programmed.

The wall console 32 preferably uses an on-board timer to create therequired frequency signal for the particular button function. In thecase of residential garages with multiple doors, a separate dooroperator and a separate wall console 32 can be used for control of eachof the doors, with the same or similar frequency selection.

As previously described, commands to effect movement of the door 10 mayalso come from a RF remote transmitter 53. Software associated with thesecondary microcontroller 1002 is also relied upon to carry out thefunction of automatically turning on the light 1070 when a valid commandto move the door is received. With reference to FIG. 21, in accordancewith steps 2100-2124, the lights can stay on for a predetermined periodof time, after which software can instruct the lights to be turned off.A button on the remote transmitter actuates a panic function, which thesoftware in the secondary microcontroller 1002 receives and decodes, andresults in sounding of an alarm 1058. Signals from any one of the remotetransmitters 53 can also be appropriately debounced.

Timer 1008D can be set to periodically interrupt the processor 30operation. This interrupt process at 1108 (FIG. 11) can be used togather inputs, perform filtering and de-bouncing, and detect wallconsole pulses at step 1110. Debouncing inputs can involve ignoringinputs for a period of time (e.g., one second) after power up to avoidfalse reads to unstable signals. After the debouncing period, acondition can require that the button be released before it can beactivated for the first time. This requirement can prevent a button fromtriggering an operation if it is held down during power up.

The inputs debounced at step 1110 can be pulse input signals from wallconsole 32, as mentioned above. For example, depression of the doorcommand button of the wall console 32 can be detected if the valuecounted on timer 1008C is in a predefined frequency range for a numberof interrupts, in which case a flag can be set to indicate that the wallconsole door button was pressed. This flag can be cleared if the valueof timer 1008C does not fall into the range for a larger number ofinterrupts. This flag can also be cleared once it has been serviced, inwhich case reset of the flag can be prevented until the number ofinterrupts occurs in which the button is not pressed. Additionally,depression of the light button on the wall console 32 can be detected ifthe timer 1008C value lies in another predefined frequency range for thesame number of interrupts, in which case a flag can be set to indicatethat the wall console light button was pressed. Again, if the timer1008C value is not in that range for the same number of interrupts, thenthis flag can be cleared. Also, the depression of vacation lock modebutton on the wall console 32 can be detected if the timer 1008C valuelies in another predefined frequency range for the same number ofinterrupts, in which case a flag can be set to indicate that the wallconsole vacation switch was actuated. As with the other button pressflags, if the timer 1008C value is not in that range for the same numberof interrupts, then this flag can be cleared. An RF keyless entry pinstate of the secondary microcontroller can be received over remotedetection line 1044. If this pin is low for a number of interrupts, aflag can be set to indicate that a door button of the remote transmitter53 was pressed. As with the flags indicating status of wall consolebutton presses, this flag can be cleared if the pin is low for apredefined number of interrupts. As with the wall console door buttonpress flag, the door button press flag on the RF transmitter 53 can alsobe cleared once it has been serviced, in which case reset of the flagcan be prevented until the precise number of interrupts occur in whichthe pin is seen low.

With respect to the location of barrier travel, the details of which aresubsequently described, this interrupt process at 1108 (FIG. 11) canalso update average motor current at step 1112, and check that theoptical wheel 1013A (FIG. 22) is moving at step 1114 when the motor ison. At step 1114, the process 1108 can send a failure event if theoptical wheel 1013 a (FIGS. 10 and 22) has not moved for a period oftime that can vary based on drive type and/or operating conditions. Atstep 1116, the target speed can be updated, and a power fail signal10138 can be checked at step 1118 to determine whether or not a powerfail handling process needs to be executed.

Referring again to FIG. 10, a dedicated hardware circuit can provide adigital AC power fail signal 1013B that transitions in the event thatthe AC power ever falls below a predetermined value (e.g., eighty-fivevolts AC). This signal 1013B is input to both the main microcontroller1000 and secondary microcontroller 1002 so that they can both monitorthe AC line. If the signal 10138 transitions, the software can recognizethat a brown-out is occurring. Upon this signal 1013B going active, themicrocontrollers can immediately stop the motor if it is in motion. Thisprocedure can include the use of a quick stop signal as described belowwith reference to FIG. 17, which can cause the motor leads to bedirectly shorted out, resulting in the motor 1022 stopping moreabruptly. Stopping the motor 1022 as soon as possible on power failuremakes it possible to accurately recover by preventing the optical wheel1013A from rotating more than one revolution after the power goes out.The software can perform necessary procedures to recover properly whenpower is restored. These procedures can include storing all necessaryvalues in the EEPROM 1016, thus ensuring that the position can berecalled again upon the subsequent power-up.

If an AC power failure signal 1013B is active (i.e., high), then abattery backup unit, if available, can be optionally used and enabled.Otherwise, an active AC power failure signal 1013B can cause the mainmicroprocessor to indicate, via fault signal 1046, that it has ceasedoperation.

Referring back to FIG. 11, following step 1120, an adapter task step1126 can be performed in which the main microcontroller 1000 performs ascan to see if an adapter 1034 (FIG. 10) is installed that allows use ofoptional wireless accessories 1036. If so, the microcontroller 1000utilizes a universal asynchronous receiver/transmitter (UART) interface1032 to communicate with the adapter 1034. This adapter 1034 can enablewireless communication, for example of 915 MHz, with any number ofexternal accessories 1036 with which the processor 30 cannot communicatenatively. A connector port such as a serial port, provided in the powerhead, can be used to supply a connection between the UART interface 1032and the adapter 1034. Other types of ports can alternatively be used, asappropriate, such as a parallel port or USB port. The accessories 1036can include, for example, non-standard remote controls, other wallconsoles, door status communication devices, setup and calibrationmodules, lights, security systems, and other desired equipment. Amessaging protocol useful for communication between the interface 1032and the adapter 1034 can implement reception of messages via aninterrupt service routine 1144 (FIG. 11), and store received messages atstep 1146 in a buffer for processing by the main loop. The adapter taskstep 1126 can parse any incoming messages and queue appropriateresponses to be sent on the next cycle. In some embodiments, all of theincoming messages can be handled before sending any messages to theadapter 1034. When the main microcontroller 1000 sends an establishcommunications message to the adapter 1034, it can wait for a period oftime (e.g., up to two seconds) for the authentication process to becompleted. If it is not completed, the main microcontroller 1000 canresend the establish communications message. This attempt to establishcommunications can continue until an authentication is completed.

The controller unit 30, and particularly the main controller 1000, canhandle many different types of messages. For example, because of thecapability of the adapter 1034 to communicate with a wide variety ofaccessories 1036, messages that can be handled at step 1126 couldinclude, as examples, authentication responses, head reset commands,operator status requests, door operation commands, light operationcommands, alarm operation commands, vacation mode commands, learn remotecommands, set limits commands, change position commands, existing andnew force profile commands, set speed commands, set force commands,raise fault commands, request fault log commands, set LEDs commands,issue diagnostics commands, and/or general acknowledgements.

The authentication response, head reset commands, and status requestscan be handled, for example, as follows. When an authentication responseis received, the main microcontroller 1000 can attempt to validate anencrypted number, and can respond with either an acceptance message oran error message. When a head reset command is received, it can beencapsulated in an expansion bus packet and queued for relay to thesecondary microcontroller 1002. The secondary microcontroller 1002 canrespond by halting for a short period of time, and then resettingitself, which can allow the main microcontroller 1000 time to save anyimportant data before it is reset during the secondary microcontroller's1002 initialization. An establish communications command can then besent once the head has re-initialized, while the adapter 1034 can allowenough time for the head to complete the requested reset. When anoperator status request is received, a message can be prepared thatcontains operator status information, and this message can be sent tothe adapter 1034.

The light operation commands, alarm operation commands, vacation modecommands, and learn remote commands can be handled, for example, asfollows. When an operate light command or an operate alarm command isreceived, then a light message or alarm message, respectively, can bequeued for communication to the secondary microcontroller 1002, andthese messages can contain appropriate parameters to accomplish theseoperations. When a vacation mode message is received, then a vacationlock can be set or released, depending on the mode received; a lockoutmessage can be queued for communication to the secondary microcontroller1002 with the appropriate mode indicated. When a learn remote command isreceived, this message can be encapsulated in an expansion bus packetand queued for delivery to the secondary microcontroller 1002.

There are various types of learn remote modes that can be handled by thesecondary microcontroller 1002. For example, if the mode is a door modeor an accessory mode, than the secondary microcontroller 1002 can entera remote learning mode and learn any remote that is activated.Additionally, a complimentary cancel learn mode message can be handledby cancelling a learn mode already entered. Also, a clear all modemessage can cause all remotes in the processor to be cleared, includingboth door and accessory remotes. In contrast, a clear accessory modemessage can cause all accessory remotes learned by the processor to becleared.

Set limits commands and change position commands can be handled at step1126 as follows. Set limits commands that are received can be handled bythe main microcontroller 1000 in much the same manner as described abovewith regard to process 1104, when such commands are received from thesecondary microcontroller 1002. One additional procedure, however, is toset contents of an adapter mode variable to indicate whether the adaptermode is a limit setting mode or an idle mode. Then, when a changeposition command is received at step 1126, it can be ignored if theadapter mode is not the limit setting mode. Otherwise, the position ofthe door can be continuously driven to the new end of travel position inthe direction indicated for setting or adjusting limits according to thedistances traveled.

New force sensitivity profile commands, set speed commands, and setforce commands can be handled at step 1126 as follows. The establishmentof the force sensitivity profile, in accordance with the principles ofthe present invention, is subsequently disclosed in great detail. Atthis point, it is only pointed out that when a new force sensitivityprofile command is received, the contents of a force profile generationvariable can be set to a value that will cause a new force profile to begenerated during the next open and close operations of the door 10,while still using the old force sensitivity profile during those twodoor operations. Once the new force profile is generated, it can besubstituted for the old force profile, and the force profile generationvariable can be reset to a different value that will not immediatelyresult in generation of a new force profile. When either the set speedcommands or set force commands are received, then these commands can behandled by the main microcontroller 1000 in much the same manner asdescribed above with regard to process 1104, when such commands arereceived from the secondary microcontroller 1002.

Raise fault commands and request fault log commands can be handled atstep 1126 as follows. When a raise fault command is received, the faultindicated can be passed to a safety event handler to be processed. Theevent handler can be used to do several things, such as halt the mainprocessor 1000 in the event of a critical error, at which point thesecondary processor 1002 can perform a reset after a timeout ofexpansion bus 1004 activity. The event handler can also disable orreverse the motor on a critical fault (e.g., STB 1030 failure, excessiveforce, etc), and keep a log in EEPROM 1016 of the last sixcritical/severe faults. A fault code (e.g., one byte) and a copy of thedays-on counter (e.g., two bytes) can be saved for each entry. The eventhandler can further send information about faults and/or system statesto the diagnostic port 1042. If the fault passed to the event handler atstep 1126 causes the main microcontroller 1000 to halt, then theresponse can be queued and sent by the safety event handler instead ofthe main microcontroller 1000. When a request fault log command isreceived, then a fault log message can be prepared and sent to theadapter 1034.

Set LEDs commands, issue diagnostics commands, and/or generalacknowledgements can be handled at step 1126 as follows. Set LEDscommands can be encapsulated in expansion bus packets and queued fordelivery to the secondary microcontroller 1002, which can parse themessage and set the operator LEDs 1040 accordingly. Similarly, issuediagnostics commands can be sent to a diagnostics system in the mainmicrocontroller 1000, which can process the commands and prepare aresponse; this response can be packed into a diagnostics responsemessage and sent back to the adapter 1034 and/or to the diagnosticsmodule 1042. When general acknowledgements are not received from theadapter 1034 as expected, thus indicating error, then the last commandsent from the main microcontroller 1000 to the adapter 1034 can be sentagain. If the general acknowledgement fails to be received apredetermined number of times (e.g., three times in a row), then themain microcontroller 1000 can attempt to start an establishcommunications sequence as described above.

Additional steps in the software control (FIG. 11) include a self testprocedure 1128 performed each cycle to verify the memory (e.g., UL1998RAM/ROM tests), check the motor current, check execution flags to ensurethat required modules are executing, and check for critical faults.Following the self test procedure 1128, a control logic routine 1130 canbe performed to analyze data collected thus far in the main loop 1100,along with other state variables, and make various decisions. Motoraction state variables can be set to be handled by the motor controlprocedure 1132. In some instances, the control logic routine can includea non-safety sub-routine that is performed before a safety subroutine.

The non-safety subroutine portion of control logic routine 1130 can beimplemented as a series of nested, conditional (e.g., fuzzy logic)operations that accomplish control of various functions of the barrieroperator. These functions can include activating or deactivating a worklight, entering or leaving a vacation mode, processing a diagnosticmessage, and/or clearing and setting flags and contents of othervariables that can affect subsequent motor operation during the motorcontrol procedure 1132. For example, if a motor is in idle mode, and ifforce profiles have been set or cleared within a last cycle of the mainloop 1100, then an expansion bus message can be queued for delivery tothe secondary microcontroller 1002 that contains force profile statusinformation.

The subsequent safety subroutine portion of control logic routine 1130can be implemented as another series of nested, conditional (e.g., fuzzylogic) operations that accomplish safety measures implemented by thebarrier operator. Such measures can include thermal protection of themotor, emergency barrier reversal (e.g., excess force detection and/orobstacle detection), and power fail handling operations. As mentionedabove, routine 1130 can also reset the safety beam (STB) 1030 pulsecounter variable to zero every main loop cycle. This pulse countervariable is the one that is incremented in step 1122 and read in step1120.

Thermal Protection of Motor

The thermal protection of the motor 28 is a safety function preferablycarried out by the main microcontroller 1000. With respect to the ACversion of the motor 28, the thermal protection is preferablyaccomplished with use of a thermal sensor hardware switch in the ACwindings that opens in response to excessive heating. Themicrocontroller 1000 monitors a status bit to indicate theaforementioned excessive thermal condition.

With respect to the DC version of the motor 28, and in accordance with afeature of the present invention, the process for detection of motortemperature is without use of a thermal sensor. Rather, the powerconsumed by the motor is monitored. Specifically, with the use of aconversion algorithm that correlates motor temperature as a function ofboth motor load and running time of the motor, the temperature of the DCmotor 28 can be accurately assessed. The algorithm is based uponincrementing a number, referred to as the thermal effectivity parameteror thermal load value (TLV). The TLV number increases with (i) the timethat the DC motor is running, as well as (ii) the extent of the load. Ifthe TLV number ever exceeds a predetermined value, experimentallyestablished for each motor, the software is then effective to shut downmotor operation for a certain “cooling off” period. The cooling offperiod is determined by experimentation as to how much the thermaleffectivity parameter should be decremented per second before the motorcan be restarted.

The main microcontroller 1000 observes the amount of time during motoroperation that is calibrated for a worst case ambient temperaturecondition. The TLV number is incremented during motor operation as afunction of time (e.g. every main loop cycle when the motor is running)and at a dynamic rate governed in part by force measured as a functionof motor current. The TLV number also is decremented as a function oftime (e.g., every main loop cycle) and at a rate governed in part by amotor cool down constant (CDC) selected to simulate motor cool downcharacteristics under worst case ambient conditions. In some instances,the worst case can assume that a worst case type of motor, barrier,drive combination is employed from among many types of motors that mightbe employed with the barrier operator. In other instances, the actualconfiguration of motor, drive, and/or door type can be determined andused to select a TLV value determined for that combination of equipmentunder worst case ambient conditions. When the TLV number exceeds thepredefined thermal overload threshold, a flag is set to indicate thermaloverload and cause motor shut down until the motor has had time to coolto an acceptable level.

As explained below, an update interval threshold (e.g., one second) canbe observed as a timer for updating a force value. When this thresholdis exceeded, then the TLV value can also be incremented if the motor isin a run mode. To increment the TLV value, the main microcontroller 1000can add a constant part and a variable part to the then-present TLV. Forexample, the maximum force value (MFV) measured since the last updateinterval threshold can be employed as a scalar for the variable part ofthe amount to add to the thermal load value. For example, the TLV can becalculated according to:

TLV=TLV+24+MFV²/4.

Regardless of whether the motor is in a run mode when the updateinterval is exceeded, the TLV value can also be decremented whenever theupdate interval timer exceeds the update interval threshold. However,the amount of the decrement can depend on whether the TLV exceeds theaforementioned thermal CDC. In particular, if the TLV is greater thanzero and less than the thermal CDC, then the TLV can simply bedecremented by a fixed amount (e.g., one). However, if the CDC isexceeded, then the TLV can be calculated when the motor is not runningas follows:

TLV=TLV−(TLV/CDC)

Whenever the update interval timer exceeds the update intervalthreshold, a check can also be executed to determine whether the TLVexceeds the aforementioned thermal overload threshold. If so, a thermalshutdown flag can be set to cause the motor to shut down, and anexpansion bus message can be queued, for delivery to the secondarymicrocontroller 1002, that enables a thermal shutdown. Once the softwaredetermines that the thermal limit has been exceeded, it can stopresponding to door commands. In addition, it can light the LEDs 1040 onthe barrier operator 30 to indicate this fault mode. In someembodiments, disconnecting the power from the unit will not clear thiscondition (e.g., store value in EEPROM). Only passage of time (i.e.,decrementing TLV) will allow the motor to operate again. Thus, the TLVcan decrement over time in the manner described above, allowing the TLVto eventually fall below the thermal overload threshold. At that point,the thermal shutdown flag is cleared and an expansion bus messagequeued, for delivery to the secondary microcontroller 1002, in order todisable the thermal shutdown.

Establishment of Force Sensitivity Thresholds and Force Measurements

After the travel limits have been established (FIG. 23), as subsequentlydescribed, and when the controller 30 is in its “learn” mode, forcesensitivity threshold limits can be established. Accordingly, as thefirst step in this process, the motor can be instructed to move the doorfrom, for example, its closed position to its open position, duringwhich time the respective forces that are required to move the dooralong the discrete segments of tracks 14 and 16 (FIG. 1), withoutinterruption, are recorded and stored. Thereafter, offsets of increasedvalue in the form of a stepped configuration are automatically generatedand stored, resulting in a defined force sensitivity threshold profile2400 (see FIG. 24). The procedure is then repeated for the movement ofthe door in the opposite direction (e.g., from its open to closedposition), and the offsets of increased value in the form of a steppedconfiguration defining that profile also automatically generated andstored. These two profiles therefore respectively define the “dooropening” and “door closing” force sensitivity thresholds, namely theupper limit of the respective forces to which the door can be subjectedbefore there is an indication of an obstruction, as it travels therespectively different segments of the tracks 14 and 16 (FIG. 1),between its open and closed positions, and vice versa. In addition,after at least one full door travel cycle has been completed, in whichthese “door opening” and “door closing” preliminary force sensitivityprofiles are established, and with the door in its stationary or“parked” position, by depression of appropriate buttons on the head unit26, for example, the user may optionally instruct the microcontroller1000 to either increase or decrease, within a limited range, the levelof these thresholds. The limitation to be placed on the total range ofuser adjustability can be, for example, about fifty percent or more ofthe total permissible force, for small measured forces, and a lowerpercent for larger measured forces. With this user adjustment, the finalforce sensitivity threshold profiles can be stored to be used during the“operate” mode of operation.

The main microcontroller 1000 thereafter automatically switches to theoperate mode, and the forces thereafter measured during normal dooroperation can be compared to the stored force sensitivity thresholdlimits of the two profiles. This measurement may or may not necessarilybe on a one for one basis. For example, multiple measurements of theactual force can continue to be taken, and then put through an algorithmto determine what is, in essence, an “effectively measured force.” Then,if the effectively measured force for a designated portion of doortravel exceeds the corresponding stored force sensitivity threshold forthat portion of travel, an obstruction can be indicated, and theappropriate response can result (e.g., the motor is stopped if the dooris on the way up, or the motor is stopped and reversed if the door is onthe way down.)

After a fixed number of cycles (e.g., approximately one-thousand cyclesor two-thousand operations), the microcontroller 1000 can bere-programmed to automatically switch back into the “learn” mode andcapture new force sensitivity threshold profiles in accordance with thepreviously described routine, using the previously stored forcesensitivity threshold limits during this re-programming in the event ofan obstruction while “learning” the new profiles. Thereafter, andsubject to again allowing the user to increase or decrease the forcesensitivity threshold limits, the new force sensitivity threshold limitsestablish the new final force sensitivity threshold limits profile(s),to be compared to the thereafter actual measured force values during thetravel of the door during its “operate mode.” If desired, thisre-programming operation may be instituted by the user to request a newforce sensitivity profile at any time by the user depressing apreselected combination of buttons on the powerhead 26.

The actual force value can be measured in alternate ways. For example,for the DC motor version, and taking advantage of the fact that force isproportional to the current through the motor, a Hall Effect sensor 1024(FIG. 10) can be used for measuring motor current, with its outputinputted along path 1024 a to the main microcontroller 1000 (as well asto microcontroller 1002). For the AC motor version, for example, takinginto consideration that force is inversely proportional to motor speed,the optical wheel 1013A can be used for measuring the speed of the motor28, with its output inputted along path 2000 to the microcontroller1000. In either event, if the force that is so measured during theoperate mode exceeds the stored force sensitivity threshold limit(determined by the increase of current over the limit in the case of theDC motor version, or decrease of motor speed below the limit in the caseof the AC motor version), such event indicates the presence of anobstruction. As a result, the microcontroller 1000 will instruct themotor 28 to either stop, or stop and reverse, depending upon thedirection of door travel, ignoring any other commands for a predefineddistance of door travel after reversal.

When the garage door 10 is in motion in the down direction and comesinto contact with an obstruction, the software causes the door to stopand, after a period of time, reverse, if the force is greater than theforce sensitivity limit for that segment of door travel as previouslydetermined by the force sensitivity limit of the force sensitivityprofile for that segment. This condition is known as “torque-out”.Thereafter, the door 10 will move to the open position unless commandedotherwise, but commands otherwise (e.g., to stop) can be ignored for ashort distance (e.g., two inches of opening door travel immediatelyafter reversal). In the event that the door is travelling upwards andcomes into contact with an obstruction, the software will cause the doorto stop without reversing. Also, the force can be ignored for the firstportion of door travel immediately upon starting the motor in order toaccount for the transient nature of the current when the motor isstarted.

The force readings can be taken repeatedly when the door is in motion,and an averaging process can be performed on a pool of recentlycollected samples. These sampled averages can then be compared againstthe force profile 2400 (FIG. 24) determined at power up, as a functionof door position. These force checks can be performed, for example, atleast every one inch of door travel. If the force exceeds the maximumallowable value that was determined at this position of the door duringforce profiling, then the software can stop the motor and perform thetorque-out procedures (i.e., stop, or stop and reverse).

The value from the Hall Effect sensor 1024 can change based ontemperature, and the main microcontroller 1000 can handle the variationsby reading the sensor 1024 prior to starting the motor, and using thereading to calibrate the sensor readings that will be taken in theupcoming run. Then, the voltage reading taken at the mainmicrocontroller 1000 during upward (V_(up)) or downward (V_(down))movement of the barrier can be adjusted for the voltage reading taken atzero current (V₀) as follows:

V _(up) =V ₀ −C*V _(up), and

V _(down) =V _(O) +C*V _(down),

where C is a constant (e.g. sixty-six one-thousandths).

As previously described, the main microcontroller 1000 samples the forceover the range of motion of the door in determining the forcesensitivity profiles, the profiles stored in non-volatile memory, suchas EEPROM 1016.

The torque profile margin or offset which the user is allowed to adjustis normally adjustable through a menu option. This margin can representmore force or less force depending on user preference. This torquemargin can also be added for different door segments. As an example, thefinal force sensitivity profiling process can produce one number ofprofile numbers for the door opening direction, and another number ofprofile numbers for the door closing direction, these numbersrepresenting the permitted force for the distinctly different segmentsof door travel.

In some instance, it may be desirable that actual force detection beperformed to compare to the force sensitivity profile 2400 (FIG. 24)during the safety subroutine of routine 1130 (FIG. 11). For example, themain microcontroller 1000 can first determine whether an update intervaltimer has exceeded a predefined update interval threshold. This updateinterval timer can be incremented at routine 1130 every main loop cycle.The update interval threshold can have a value (in main loop cycles)preselected to cause update periodically (e.g., every second), at whichpoint the update interval timer, and a periodic maximum force variablecontaining the maximum force value measured in a last period of time(e.g., one second), can be reset to zero in routine 1130. Thus, whilethe maximum force reading can be updated every cycle with the currentforce reading if the current reading is higher than the value stored inthe maximum force reading, the update interval threshold can cause themaximum force reading to be cleared periodically (e.g., every second).Clearing the maximum force reading periodically (e.g., once per second)ensures that the maximum force reading reflects a force measured withinthe predetermined period of time (e.g., one second).

The obstruction-caused barrier stop and/or reversal operations carriedout in routine 1130 involve excess force detection. For example, theforce detection process involves creating and using a force profile thatis developed from average motor current recorded for discrete ranges ofbarrier travel position. During normal operation, the average motorcurrent is updated every cycle as part of interrupt process 1108. Thus,actual force (F) can be calculated every cycle from the average motorcurrent (C), the zero current level (C₀) measured during initialization,PWM duty cycle (D), and a maximum duty cycle (D_(MAX)) as follows:

F=(abs(C−C ₀)*(D/D _(MAX))).

In the garage door operation previously described, separate profiles aredeveloped for the upward travel path and for the downward travel path,respectively, and user adjustable offsets from these profiles used asthresholds to detect the excess force. After a break-in period, (forexample, after one-thousand completed cycles of upward and downwardgarage door movement), the new force sensitivity profiles can beobtained, and flags can be set to indicate that new profiles do not needto be obtained again to account for a break in period. The old forcesensitivity profiles can be considered to be reliable enough to useduring this process, but then discarded once the new profiles areobtained. New profiles can also be obtained when travel limits arerecalibrated, and the force profiles can be ignored during limitcalibration and during the first two full runs after limit calibration.When a force profile is not used, a predefined maximum force limit canbe employed (e.g., a maximum of thirty amps DC during calibration, amaximum of two amps if force profiles have not yet been calibrated).

As shown in FIG. 24, one component of the excess force detection carriedout at routine 1130 can involve ignoring force limits 2400 imposed by aforce sensitivity profile during the first few moments of motoroperation. In ignoring these force limits 2400, the main microcontroller1000 can compare a run time of the motor (i.e., a number of cycles sincethe motor was last started) to a predefined temporal threshold (e.g.,number of cycles), and ignore the force limits 2400 if this temporalthreshold is not exceeded. However, once the temporal threshold isexceeded, then the routine 1130 can calculate a current force valuebased on an average motor current reading, and obtain a force limit froma table of force limit values indexed by the barrier position and theuser defined offset value.

If the motor is in a run mode, if the current door position is in adesignated force measurement position for a predefined segment of doortravel, and if no bit(s) or flag(s) have been set to indicate that aforce profile update has already occurred for both up and down forceprofiles, then the current force value can be stored in a door positionindexed array of measured force values at a location indexed for storingthe measured force value for the current barrier position. This arraycan be used to collect a new profile that can be used to replace an oldprofile, if needed. However, if the motor is in an idle mode, then thisarray, the current force value, and the force limit can all be clearedor reset to zero.

In detecting excess force, routine 1130 can set the motor mode to a stopmode if the following conditions are met: the motor is in run mode,flags indicate that force sensitivity profiles are available, an ACpower fail signal is low (indicating that AC power is available), andthe calculated force is greater than the force limit. Following routine1130, motor control procedure 1132 can proceed according to one ofseveral top level motor states that the motor will enter based on datacollected in the main loop as described above. For example, the motorcan be stopped if a thermal shutdown mode has been triggered.

Following passage of the safety and non-safety start motor checks, asafety related initialization procedure can prepare the motor formovement. For example, if the lifetime cycle count exceeds apredetermined force profile update threshold (e.g., two-thousandcycles), and if a bit or flag has not been set to indicate that theforce profile has already been updated, then a flag can be set to causethe force sensitivity profile to be updated based on the next two fullruns.

Establishment and Monitoring of Travel Limits

Referring now to FIG. 22 and FIG. 23, the establishment of the doortravel limits is described. With the operator processor initially placedin the “learn” mode, these limits can be initially set (stored) by the“user” (e.g., homeowner, installer) in memory associated with the mainmicrocontroller 1000 (FIG. 10), more particularly in the stand-aloneon-board EEPROM 1016, during a full open/close cycle of the door.Specifically, the learn mode of the processor can initially beimplemented through user-actuation of the button switches on the headunit. Then, after actuation of the motor to move the door, for exampleupwardly from its closed position, the user can press the appropriatebutton, halting the door when the door reaches the desired “open”position, and this position is stored as the upper travel limit 2300.The operator is then actuated to close the door, and the user in similarmanner halts the door when it reaches the desired “closed” position, atwhich time the lower travel limit 2302 is stored. Alternatively, theuser may choose to use this procedure to set and store the lower travellimit first, followed by the setting and storing of the upper travellimit when the operator 20 is thereafter moved to the “operate” mode;the electronically set upper and lower travel limits define the extentof door travel.

The method for determining position of the door employs an optical lightbeam sensor that outputs voltage pulses whenever the light beam isinterrupted. Specifically, an optical wheel 1013A (FIGS. 10 and 22) isattached to the shaft of motor 28. The teeth or paddles of the wheel1013A break the light beam as the motor shaft rotates, causing pulsedinterrupts to the main microcontroller 1000. A multipaddle (i.e. four,eight, twelve, etc.) optical-wheel available from TORMATIC®, and asdescribed in U.S. Pat. No. 7,339,338, which is incorporated herein byreference in its entirety for all purposes, can be used for thispurpose. By keeping track of the number of interrupts that it hasreceived, the main microcontroller 1000 can know and monitor theposition of the door as it is moving up and down the rail. A counter canbe incremented and decremented at step 1140 (see FIG. 11) as the doormoves in either direction.

During the travel limit setting process, numbers can be obtained fromthis counter and stored in EEPROM 1016 (see FIG. 10), and these numberscorrespond to the “up” (door open) travel limit 2300 and “down” (doorclose) travel limit 2302. These travel limits stored in EEPROM 1016 canbe used from this time forward (or until they are reset) to stop thedoor at the ends of the tracks 14 and 16 (FIG. 1). In other words, asthe main microcontroller 1000 (FIG. 10) is running the door up and/ordown the tracks, it can, in step 1142 (FIG. 11), continually check thevalue of the position counter updated in step 1140 versus these pre-setlimits, and it can shut the motor off when the travel position of thedoor is the same as the travel limit position. The main microcontroller(see FIG. 10) can disallow door motion until the travel limits 2300 and2302 are set. The LEDs 1040 on the operator head unit 26 indicate thisstate.

As mentioned, the opto-sensor generates a pulse interrupt to the mainmicrocontroller 1000 every time the optical wheel 1030A breaks the lightbeam. A timer can be used to measure the time between interrupts. Bymeasuring the time of two consecutive periods, it can be determined ifthe reference paddle was seen (for the reference paddle, the two periodswould no longer be 50/50 but roughly 70/30). The reference paddle 2200can be used as a check to make sure that the physical location of thecarriage 50 along rail 22 (and therefore the position of door 10 alongtracks 14 and 16) is where it is intended to be. The number of referencepaddle 2200 rotations can be used as a check because it can be knownthat a certain amount of reference paddles 2200 should correspond to acertain number of non-reference paddles.

It should be understood that various embodiments of the barrier operatorcan have different types of wheels, drives, motors, and reduction gears.For belt and chain units employing a CHIPPEWA® motor, a twelve toothpaddle wheel can be used in conjunction with a forty to one reductiongear. For screw drive units employing a JOHNSON® 1500 motor, a fourtooth paddle wheel can be used in conjunction with a four to onereduction gear. Thus, a drive profile can specify the information neededto determine the barrier position, including the number of optical wheelpaddles.

In the open position, the count can start at a number greater than zeroto leave some room to mechanically slide past so that the counter neverunderflows. Reference pulses count from the opposite direction as shownin FIG. 23. In some embodiments, the software limits rely on themechanical design having a trolley that can only re-attach at one pointon the rail (for all types screw, belt, and chain). Without this singlepoint of attachment, the software would be lost (unknowingly) in regardsto true position of the door if the trolley was reattached in adifferent location. With the single attachment point, the software cankeep accurate track of the door at all times with no drifting of thelimits. This accuracy can also be accomplished in the event (or events)of any power outages (or brownouts), as well as under conditions whenthe power input is stable.

Returning now to FIG. 10 and FIG. 11 and referring generally thereto,the stop mode in procedure 1132 starts the process of stopping themotor. Its primary purpose is to disable the motor, but it is alsoresponsible for modifying some state variables. For example, anexpansion bus message can be queued for delivery to the secondarymicrocontroller 1002 to disable the motor relay, and this message caninclude information about whether or not the barrier stopped at a limit.

The stopping mode can respond to an almost full run by storing a set offorce points associated with a door open or a door close (e.g., fiveforce points for a door open, eight force points for a door close), andused to determine when an unusual force is encountered. A copy of thesesets of force points can be stored in and initialized from EEPROM 1016or set to zero in the event of a CRC failure, and filled in after motorstop on the first full open run after limit calibration. For example, ifan almost full run occurs (e.g., within one optical wheel rotation ofthe upper and lower limits) then the set of force points for thedirection of travel can be created in EEPROM 1016 if it is not alreadycreated or if it requires an update. If a limit to limit run was notcompleted, then this profile can be set to update on the next run. Tocomplete the stopping mode, a current position can be recorded as anidle position, the motor direction can be set to off, and the run timecan be set to zero. Then, a next direction field can be toggled, and thetarget time (i.e., the number of microseconds expected between paddleson the optical wheel) can be set to zero.

Following procedure 1132, at the bottom of the main loop, a local cyclecounter as well as a cycle counter can be incremented. If the localcycle counter is greater than or equal to a predetermined thresholdselected to reset the counter once per day, then a days on counter canbe incremented in EEPROM 1016, and the local cycle counter can be reset.At this point, a watchdog timer can be reset, and this timer can beobserved at step 1102 to wait for the timer to indicate fiftymilliseconds have passed in this cycle before restarting the loop. Whilewaiting for the next loop iteration, if the motor mode is not the runmode, then an EEPROM task step 1136 can be performed. The mainmicrocontroller 1000 can store a copy of one-hundred twenty-eight bytesof the EEPROM 1016 in RAM and also have a corresponding set ofone-hundred twenty-eight flags which can be set if a value changes. AnEEPROM queue system can queue up writes for the data that has changedduring the cycle. For example, if a motor configuration is changed, thenthis value can be written, and a CRC updated. Each changed data bit canhave a bit changed in the changed array. At step 1136, the change bitsfor the EEPROM data (bottom up) can be checked and, if a change is foundand the EEPROM 1016 is not busy, the byte can be written to the EEPROM1016. The EEPROM 1016 can return an ACK (‘0’) when the write cycle iscomplete. The EEPROM 1016 can be polled and if it returns an ACK, then awrite can be initiated.

As mentioned above, the secondary microcontroller 1002 in the head ofthe barrier operator system can have two primary responsibilities. Thefirst is to act as a safety double check within the system. Thesecondary microcontroller 1002 can perform safety checks and, whenappropriate, can disable the motor or perform other safety relatedfunctions. The safety checks can include some basic sanity checks forensuring the main microcontroller 1000 is in good health. Secondly, thesecondary microcontroller 1002 can provide some interface functions tothe outside world; for example, managing a KEELOQ® protocol.

As described above, the secondary microcontroller 1002 can communicatewith the main microcontroller 1000 over the expansion bus 1004. MSSP1043 can be used for this task. The secondary microcontroller 1002 canbe responsible for handling certain messages from the adapter 1034.These messages can be forwarded to the secondary microcontroller 1002via the expansion bus 1004 protocol, and the responses can be sent asuninitiated requests which the main microcontroller 1000 then forwardsto the adapter 1034.

In addition to the expansion bus 1004 as described above, the secondarymicrocontroller 1002 can communicate with the main microcontroller viaone or more additional lines. For example, a remote detection line 1044can be set HIGH to tell the main microcontroller 1000 that a KEELOQ®command has been received, and to open the door. Line 1044 can be setLOW after a predetermined amount of time (e.g., six hundredmilliseconds). If the main microcontroller 1000 did not handle thispulse within the predetermined amount of time, then it can be assumedthat the main microcontroller 1000 is busy, or that the STB 1030 orother event is stopping the barrier. Additionally, another line 1046 canbe driven low by the main microcontroller 1000 to indicate that a faulthas occurred. The secondary microcontroller 1002 can cease looking forexpansion bus 1004 messages, disable an operator UI, and disable themotor enable and light relays. Once this is done, the secondarymicrocontroller 1002 can flash both of its operator LEDs 1040 red toindicate the halt. During this time, the secondary microcontroller canrun on a sixty-five millisecond loop time using a timer 1048 overflowflag as a signal to begin a new loop.

The operator UI can allow a user to program speed, adjust force limits,calibrate door limits, and learn remotes. Updated values can be sent tothe main microcontroller 1000 via the expansion bus 1004 based on userinput. When idle, the operator UI can display specific fault conditionson the status LEDs 1040. Common fault conditions can be non-calibratedlimits, torque-out, vacation mode, etc. These LEDs 1040 can also be usedto indicate when a valid RF signal is heard while the motor is idle, andindicate whether the RF signal was of one access code protocol (e.g.,INTELLICODE® I) or of another access code protocol (e.g., INTELLICODE®II),a description of which is subsequently described. INTELLICODE® I andINTELLICODE® II are the respective designations for two different accesscode protocols developed and used by Overhead Door Corporation, theassignee of the inventions of this application.

The INTELLICODE® I access code protocol is described in U.S. Pat. No.6,667,684, specifically at Col. 4, line 49 through Col. 6, line 15,assigned to the assignee of the present invention; this patent isincorporated by reference herein in its entirety for all purposes. Thecontroller software of the barrier operator 20 is effective to decodeboth the INTELLICODE® I code transmissions from one set of transmitters53 and the INTELLICODE® II code transmissions from a different set oftransmitters 53, the latter utilizing the secure signature bits, asdescribed below with reference to FIG. 25.

INTELLICODE® II Access Code Protocol

The INTELLICODE® II code, described in greater detail below withreference to FIG. 25, includes, inter alia, the generation of a CRCchecksum from the rolling code and signing the rolling code with adigital signature. It can then prepend a serial number and append partof the unsigned rolling code to arrive at a seventy-two bit rollingcode. The INTELLICODE® II code protocol uses a twenty-four bitsynchronization counter instead of a sixteen bit synchronizationcounter. Thus, it can be distinguished from the INTELLICODE® I codeversion by starting off generating the a thirty-two bit hopping codeusing the same encryption process as the INTELLICODE® I version, exceptwith a twenty-four bit, rather than a sixteen bit, synchronizationcounter being included in the seed upon which the encryption is applied.Then, it calculates a checksum from the thirty-two bit hopping code.Thereafter, it uses a sixty-four bit signature key in applying adecryption process to a seed composed of part of that checksum and partof that hopping code, thus making a new thirty-two bit hopping code.Then, it attaches a twenty-eight bit serial number and another part ofthe first hopping code to the second thirty-two bit hopping code toarrive at the final seventy-two bit codeword.

Transmission of Access Codes

The hand-held transmitters 53 (and the keypad console when transmittingwireless RF transmissions) automatically toggle between 315 Mhz and 390Mhz RF transmissions in response to a predetermined number (e.g., five)of identical information packets (e.g., KEELOQ® information packets)that are sent on each channel, the receiver in the door operator 20synchronously toggling with such transmissions. This toggling enablesthe receiver to choose the strongest signal. Additional detailsregarding this functionality can be found in U.S. Pat. App. Pub. No.2010/0301999, assigned to the assignee of the present invention, thedisclosure of which is incorporated herein by reference in its entiretyfor all purposes.

In accordance with another feature of the inventions described herein,the transmitters 53 have the ability to switch back and forth totransmit both INTELLICODE® I access codes and INTELLICODE® II accesscodes. Specifically, and as an illustration, a user presses and holds abutton on the transmitter down for a predetermined time followed by aconfirmation depression, and pursuant to software control, thetransmitter can then function to transmit INTELLICODE® I codetransmissions while prior to that procedure, it was only transmittingINTELLICODE® II access codes.

The receiver in the operator 20 also has the ability to decodeINTELLICODE® I or INTELLICODE® II transmissions. For example, aftermoving the operator to the “learn” mode, the user can initially transmita previously learned INTELLICODE® II code from the transmitter, and thereceiver can respond by opening a window of time for it to listen for anINTELLICODE® I signal, at which time a transmitter with the INTELLICODE®I code may be actuated, and the receiver learns the INTELLICODE® I code.

Accordingly, the LEDs 1040 can blink different colors depending on whichtype of signal was received. These LEDs 1040 can additionally be used toindicate learning mode states. For example, a right LED can blink onecolor (e.g., purple) while waiting for a signal to learn. Also, if alearned INTELLICODE® II remote is heard, then when a certain time window(e.g., thirty seconds) is opened for accepting new INTELLICODE® Iremotes, both LEDs 1040 can blink purple during this thirty secondwindow. Additionally, if an INTELLICODE® I remote is heard, both LEDs1040 can stay solid color (e.g., purple) until it is heard again, atwhich point the information authorizing the remote can be saved to aninternal EEPROM. However, if a user presses both up and down buttons onthe remote and holds them down for a requisite period of time (e.g.,three seconds) while the window for learning a remote is open, then alllearned KEELOQ® information packets can be erased, and the LEDs 1040 cansupply an appropriate confirmation of completion of this operation.

Secondary Microprocessor and Associated Software Routines

Timer 1048 of the secondary microprocessor 1002 can be used as a freestanding timer. For example, timer 1048 can be set with a 2× prescalerto give timer 1048 a resolution of one millisecond per-tick, and asixty-five and five-hundred thirty-five milliseconds overflow. In someembodiments, there may not be an over-flow interrupt, but the interruptflag can still be polled. Timer 1048 can be used to determine a rate atwhich the main microcontroller 1000 is communicating over the expansionbus 1004, to determine if it is polling at the wrong rate, so that itcan be verified that the main microcontroller is running at the correctspeed, and can also be used for KEELOQ® tasks.

Secondary microcontroller 1002 can have a number of additional timers,an internal oscillator, and a secondary device. For example, timer 1054and CCP2 1056 can be used for a PWM for a buzzer alarm 1058. Timer 1054can be configured with a sixteen times prescaler, and a period registerof OxFF (i.e., approximate PWM frequency of one-hundred twenty-twohertz). The duty cycle can be set to fifty percent. Also, an internaloscillator can be set to operate the microcontroller, for example, ateight megahertz, resulting in the secondary microcontroller 1002 havinga speed of one instruction every five tenths microseconds. A KEELOQ®interrupt, described below with reference to FIG. 12, can consume asignificant portion of the secondary microcontroller 1002 processingpower. Therefore, the operational instruction time can be much longerthan five tenths microseconds. Additionally, a watchdog timer (WDT) 1060can be set to reset the microcontroller every one-hundred forty-fourmilliseconds if the WDT 1060 is not cleared. Also, timer 1062 can beused by the KEELOQ® system to poll the RF line 1064 connected toreceiver 1066. Timer 1062 can be set to cause an interrupt at, forexample, sixty microseconds. Further, the motion detector 1068 can behard wired into a pin of the secondary microcontroller 1002 that isutilized for a secondary device. If the secondary device detectsmovement, then it can turn on a head lamp 1070 for a given number ofcycles selected to turn on the light for a desired amount of time (e.g.,four minutes).

The secondary microcontroller 1002 can have an internal EEPROM used tostore configuration values, such as KEELOQ® serial numbers and KEELOQ®synch counters. The worst case write time for a byte to this internalEEPROM can be, for example, six milliseconds. Bytes of the internalEEPROM can be configured to store various types of bytes. For example,the synch counter of the first stored KEELOQ® remote can be stored, withan upper byte holding the lower eight bits of the discrimination bits inthe case of an INTELLICODE® I remote. Also, the internal EEPROM can beused to store type information for the first remote. Additionally, foreach stored remote, the internal EEPROM can store an encoding scheme(INTELLICODE® I or INTELLICODE® II) and whether it is an accessoryremote or a door remote.

Referring now to FIG. 12 through FIG. 20, the flow diagram softwareprocessing for the secondary microprocessor 1002 is now described. Theprocess includes an initialization procedure 1200 (FIG. 12) and a mainloop that can begin with a main synch task 1202. The main synch task1202 can wait for a new request from the main microcontroller 1000. Inthe case that a new request is periodically sent by the mainmicrocontroller 1000 (e.g., every fifty milliseconds), the tasks afterthe main synch task can assume that they will be called periodically(e.g., once every fifty milliseconds). These tasks can include a safetytask 1204 that verifies the system and prevents motor usage if unstable,and an operator UI task 1206 that displays faults on the LEDs andhandles program and up/down button presses. The tasks in the main loopcan further include a KEELOQ® task 1208 that handles a completed KEELOQ®packet, and a light/alarm task 1210 that checks the motion detector andturns off the light and alarm after a given duration.

Referring to FIG. 13, the initialization procedure 1200 (FIG. 12) canbegin at step 1300 by preparing the general purpose input output portsof the secondary microcontroller 1002, followed by holding the mastermicrocontroller 1000 in reset. If the cause of the reset is determinedat decision step 1304 to be the WDT 1060 (FIG. 11), then a counterrecording the number of resets of the master microcontroller 1000 can beincremented at step 1306. Otherwise, at step 1308, a power up event canbe issued, and the counter recording the number of resets can be set tozero. Next, at step 1310, the internal oscillator, timers 1048, 1062,and 1054, WDT 1060, and PWM can be prepared as described above. Finally,at step 1312, initialization can be performed for the internal EEPROM,expansion bus (e.g., set the I²C slave address to a value stored in aconfiguration file), ADC and designated safety memory, headlamp, alarm,operator UI, and timer 1062 (see FIG. 11) interrupt service routine(e.g. decode and store incoming KEELOQ® RF data).

Turning now to FIG. 14, the main synch task 1202 (see FIG. 12) can set avariable at step 1400 equal to the value of the timer 1048 (see FIG.11), so that it can be determined at decision steps 1402A and 1402Bwhether a maximum number of timer overflows has been exceeded. Thesedecisions can be based on a difference between the value recorded atstep 1400 and the respective timer values at steps 1402A and 1402B, andwhether that difference exceeds a maximum overflow threshold. Exceedingthis maximum overflow threshold can cause an appropriate timer overflowevent to be triggered at steps 1404A and 14048.

Following step 1400, an expansion bus link task can be conducted at step1406, and this expansion bus link task is detailed in FIG. 15. In FIG.15, the expansion bus link task can begin at step 1500 by polling theflag set by the I²C interrupt service routine as discussed above. If theflag is not set, then the expansion bus link task can be skipped.Otherwise, a determination can be made at decision step 1502 whether anaddress byte is observed. If so, then expansion bus timer variables canbe set to record the last two timer 1048 values so that these values canbe compared to determine rate failure in the main synch task 1202 (seeFIG. 12) at step 1408 (see FIG. 14). Then, depending on whether a reador write is being made, as determined at decision step 1506, furtherdeterminations can respectively be made, at decision steps 1508 and1510, regarding whether the expansion bus receive queue contains apacket that needs to be dealt with, or whether the expansion bustransmit queue contains a packet that needs to be transmitted. Forexample, steps 1508 and 1510 can be accomplished by checking flags setto indicate these statuses. If it is determined at step 1508 that thereceive queue already contains a packet, then the newly received packetcan be ignored at step 1512. Otherwise, the new packet can be read andstored to the receive queue at step 1514, and the flag can be set toindicate that the receive queue contains a packet at step 1516. If it isdetermined at step 1510 that the transmit queue does not contain apacket already, then null values can be sent to all at step 1518.Otherwise, the packet in the transmit queue can be sent at step 1520,and the flag can be set at step 1522 to indicate that the transmit queueis empty.

Returning now to FIG. 14, following the expansion bus link taskconducted at step 1406, a determination next follows, at decision step1410, whether the flag is set to indicate that there is a packet in thereceive queue. If not, then decision step 1402 determines whether excessoverflow of timer 1048 (see FIG. 11) has occurred. If so, then thetimeout event is triggered at step 1404A, and processing returns to step1400. Otherwise, processing returns to step 1406. However, if decisionstep 1410 is passed, then the timer values are compared at step 1408 asdiscussed above to determine whether the rate of communication is withinan expected range. If so, and if a determination is made, at decisionstep 1412, that a retry flag is set to prevent a retry, then a rateevent is triggered at step 1414, LEDs are operated to show a fail statusat step 2000 (see FIG. 20), and at step 2002 (see FIG. 20), a motorrelay is disabled and a flag is set to indicate that the motor is notenabled.

If it is determined at decision step 1412 that a retry flag is not setto prevent a retry, then the retry flag can be set at step 1416 toprevent a retry attempt. Then, following step 1408 in the event the ratewas in the acceptable range, and following step 1416, a determinationcan be made at decision step 1418 whether a sequence number is valid. Ifso, and if a CRC is also determined to be valid at decision step 1420,then the retry flag can be set to allow a retry attempt at step 1422,and an expansion bus request can be handled at expansion bus requesthandling step 1424.

Turning briefly to FIG. 16, the process for carrying out the expansionbus request handling step 1424 (see FIG. 14) can first determine whatkind of request is being handled. For example, determinations can bemade at steps 1600-1612 whether the request is: a door status request(i.e., step 1600); a light command (i.e., step 1602); an alarm siren(i.e., step 1604); an STB error lockout command, thermal overload, orforce error (i.e., step 1606); a module identity request (i.e., step1608); a voltage/current read request (i.e., step 1610); or a getuninitiated packet request (i.e., step 1612). Processing of the requestcan vary depending on these conditions. However, if the request is notrecognized at all, then a message can be queued at step 1648 fordelivery over the expansion bus to indicate that the request wasunknown, followed by setting expansion bus status flags at step 1624 toindicate that the expansion bus is ready to transmit, and that it is notready to receive.

In the event of a door status request at step 1600, a furtherdetermination can be made at decision step 1614 whether the barrier isopening. If so, then the motor can be enabled at step 1616; if not, thenthe motor can be disabled at step 1618. Disabling the motor at step 1618can involve setting a flag to indicate that the motor is disabled, andalso disabling a motor enable pin. In contrast, enabling the motor atstep 1616 can involve setting a flag to indicate that the motor isenabled, but without turning on a motor drive pin. In either case, steps1616 and 1618 can both be followed by step 1620, at which flagsindicating a STB operator user interface fault and/or a force operatoruser interface fault can be cleared. Then, a response message can bequeued at step 1622 that indicates completion of the request, and theexpansion bus status flags discussed above can be set at step 1624.

In the case of a light command at step 1602, the light control globalscan be set at step 1626, and the light can be turned on or off asrequested at step 1628. Step 1628 can be followed by step 1622 and step1624 as described above. Similarly, in the case of an alarm siren atstep 1604, the alarm control globals can be set at step 1630, and thealarm can be turned on or off as requested at step 1632. Step 1632 canalso be followed by step 1622 and step 1624, as described above.However, in the case of an STB error lockout command, thermal overload,or force error at step 1606, the operator UI fault can be cleared atstep 1634. Then, if it is a force error or STB error lockout command,the motor can be disabled at step 1636, which can entail disabling themotor drive pin and setting a motor enable flag to indicate that themotor is not enabled. Then, step 1636 can be followed by step 1622 andstep 1624 as described above.

In the case of a module identity request at step 1608 or avoltage/current read request at step 1610, appropriate response messagescan be queued respectively at step 1638 and step 1640, and these stepscan be followed by step 1624 as described above. However, in the case ofa get uninitiated packet request at step 1612, a further determinationcan be made at decision step 1642 whether there is an uninitiated packetin the queue. If so, then the uninitiated packet can be queued at step1644 for delivery over the expansion bus. Otherwise, a response messagecontaining no data can be queued at step 1646 for delivery over theexpansion bus. In either case, step 1644 and step 1646 can be followedby step 1624 as described above.

Returning now to FIG. 14, following step 1424, an expansion bus linktask step 1426 can be preformed. This expansion bus link task step 1426can be the same procedure performed at step 1406, as described in detailabove with reference to FIG. 15. Then, a determination can be made atdecision step 1428 whether the expansion bus transmit flag is set toindicate readiness of the expansion bus to transmit. If not, then themaster sync task step 1202 (see FIG. 12) can be complete. Otherwise,processing proceeds through step 1402B and step 1404B as describedabove, and thereafter returns to step 1400 as also described above.

Another branch of processing can be followed after step 1418 if thesequence number is not determined to be valid. In this case, adetermination can be made at step 1430 whether the retry flag is set topermit a retry attempt. If so, then the retry flag can be reset at step1432 to disallow a further retry attempt, and a generic response can bequeued at step 1434, after which processing proceeds to step 1426 asdescribed above. However, if the retry flag is determined at step 1430to be set to disallow a retry attempt, then a sequence number errorevent can be triggered at step 1436, followed by steps 2000 and 2002(see FIG. 20) as described above.

Another branch of processing can be followed after step 1420 if the CRCis not determined to be valid. In this case, a determination can be madeat step 1438 whether the retry flag is set to permit a retry attempt. Ifso, then the retry flag can be reset at step 1432 to disallow a furtherretry attempt, and a generic response can be queued at step 1434, afterwhich processing can proceed to step 1426 as described above. However,if the retry flag is determined at step 1438 to be set to disallow aretry attempt, then a CRC error event can be triggered at step 1440,followed by steps 2000 and 2002 (see FIG. 20) as described above. If anevent occurs that requires reset of the Main processor, an event systemcan disable the motor if it was already enabled.

Turning now to FIG. 17, the motor safety task 1204 (see FIG. 12) canbegin with verifying the ROM and RAM at step 1700. Turning briefly toFIG. 18, the process employed to verify the ROM and RAM can be skippedif a determination is made at step 1800 that a KEELOQ® task is busy.Otherwise, a value stored in a state variable can determine which one ofthree branch components of the process can be followed for this cycle.For example, when the state variable is determined to have a zero valueat step 1802, then a determination can follow at step 1804 whether allof the RAM locations can be verified. If so, then the state variable canbe incremented at step 1806, and step 1700 (see FIG. 17) thus completedfor this cycle. If the RAM locations cannot be verified at step 1804,then a RAM failure event can be triggered at step 1808, thus completingstep 1700 (see FIG. 17) for this cycle. However, if the state variableis determined to have a non-zero value at step 1802, then a sum can betaken of the total ROM chunks at step 1810. Then, if the number of ROMchunks summed in step 1810 is determined at step 1812 not to be equal tothe value of the state variable, the state variable can be incrementedat step 1814, completing step 1700 (see FIG. 17) for this cycle. Oncethe state variable has been incremented to a value that is determined atstep 1812 to match the number of ROM chunks summed in step 1810, then adetermination can be made at step 1816 whether the ROM sum can beverified. If not, then a ROM failure event can be triggered at step1818. In either case, step 1816 can be followed by resetting the statevariable value to zero before ending step 1700 (see FIG. 17) for thiscycle.

Returning now to FIG. 17, following step 1700, a number of decisions canbe made regarding whether to disable or enable a motor relay and/or aquick stop relay. With regard to these decisions, it should beunderstood that, in some embodiments, the quick stop relay is alwaysdisabled prior to a motor enable being activated. It should also beunderstood that, when the motor enable relay 1019 is deactivated, aquick stop delay counter can be set to one (e.g., fifty milliseconds),thus ensuring that the quick stop relay can activate fifty millisecondsafter the motor enable relay 1019 is deactivated. Additionally, itshould be understood that, before activating the motor enable, an ACpower fail line can be checked. If it is high (active), a power failureevent can be triggered, thus temporarily disabling the motor enablerelay 1019. However, if the AC power fail line has gone low (inactive)and if a flag is set to indicate that the motor is enabled, then themotor enable relay 1019 can be activated again. Further, if the motorstarted on battery backup, the motor enable can be prevented fromactivating when power is returned during a run. Instead, the motorenable can stay deactivated to allow completion of the run on thebattery backup, and the next run can return to normal operation. Yetfurther, if a flag is set to indicate a critical fault condition, thenthe quick stop relay can be prevented from activating, thus preventingdangerous conditions in the case of component failure. Finally, if theAC power fail line is active (high), the quick stop relay can only stayactivated for two-hundred fifty milliseconds after disabling the motor,thus providing a quick stop in the event of a power failure, butavoiding needless drain of the battery backup, if connected.

An example procedure for carrying out step 1204 (see FIG. 12), followingstep 1700, can include reading the DC current at step 1702 and storingthe value in a variable. Then, if an AC power fail is determined to beactive at step 1704, and if it is determined at step 1706 that a batterybackup unit is not connected, then a power fail event can be triggeredat step 1708. However, if the battery backup unit is determined to beconnected at step 1706, then the motor relay 1019 can be disabled atstep 1710. Otherwise, if an AC power fail is not determined to be activeat step 1704, then a determination can be made at step 1712 whether aflag is set to indicate that the motor is enabled. If not, then anotherdetermination can be made at step 1714 whether the quick stop delaycounter is at a zero value. If so, then a further determination can bemade at step 1716 whether a flag is set to indicate that a quick stop isenabled. If not, then the quick stop relay can be enabled at step 1718,and the quick stop flag can be set at step 1720 to indicate that thequick stop is enabled. Then the quick stop delay counter can be setequal to two at step 1722.

If the determination is made at step 1712 that the motor enabled flagwas set to indicate that the motor was not enabled, then furtherdeterminations can be made at steps 1724-1728 whether the flag is set toindicate that a quick stop is enabled (i.e., step 1724), whether thequick stop delay counter is at a zero value (i.e., step 1726), andwhether the AC power fail is active (i.e., step 1728). If the quick stopis not already enabled, the quick stop delay counter is at zero, and theAC power fail is not active, then the motor relay can be enabled at step1730. On the other hand, if the quick stop was determined to be enabledat step 1724, but it is determined at step 1732 that the quick stopdelay counter value has not yet reached zero, then the quick stop relaycan be disabled at step 1734, and the quick stop flag can be reset atstep 1736 to indicate that the quick stop is not enabled.

At the end of the example procedure for carrying out step 1204 (see FIG.12), the quick stop delay counter and a counter recording the number ofresets of the main microcontroller 1000 (FIG. 10) can be managed. Forexample, a determination can be made at step 1738 whether the quick stopdelay counter value is greater than zero, and if so, this counter can bedecremented at step 1740. Also, a determination can be made at step 1742whether a number of cycles has passed for decrementing the counterstoring the number of master resets. If so, then this counter can alsobe decremented at step 1744.

Turning now to FIG. 19 and FIG. 20, step 1206 (FIG. 12) can displayfaults on the LEDs 1040 (FIG. 10) and handle presses of up, down, andprogram buttons 1072 (see FIG. 10). Steps 1900-1912 can accomplishdebounce of buttons, check button press duration, display faults,respond to calibration and setup menu selections, and, if the userselects to set limits, perform entry to limit setting procedures,wherein steps 2004-2038 can set mode variables and flags for setting oflimits, check with the main microcontroller 1000 to determine if limitsetting can be performed, and perform the limit setting procedure incoordination with the main microcontroller.

Motor Configuration Bits Define Performance Characteristics

If the user's choice is determined at step 1914 to be a choice to setthe barrier (door) speed, then the speed choice can be obtained at step1916, and a message can be queued at step 1918 for delivery over theexpansion bus to indicate the chosen speed adjustment. In order to allowthe user to adjust barrier speed, a matrix can be employed to offer somepreset options based on the drive and motor types that are present. Forexample, this matrix can define “good”, “better”, and “best” versions ofscrew, belt, and chain drives with both AC and DC motors.Good/Better/Best features in accordance with this feature of theinvention, is a difference in software. Thus, in some embodiments, onesoftware image can be able to control all types of motors and drivesystems in a family of barrier opener products having various types ofdrives and motors. Software can determine which type of unit it isoperating from a value stored in EEPROM 1016 (FIG. 10), and this valuecan be programmed into the EEPROM 1016 at the factory. For example, inaccordance with one of the unique features of the invention, motorconfiguration bits can be programmed into the EEPROM 1016 (see FIG. 10)at the factory, and these bits can be read any time the unit is poweredup. Thus, they can identify for the software what type of unit it is tobe (belt, chain, screw/good, better, best). This information indicateswhat level of performance is to be delivered from the motor. In thisway, one software image can be able to control all operators regardlessof variety in motor type or drive type.

The speed of the DC motor can depend, among other things, upon thecharacteristics of the operator. For example in the DC version, thesoftware can determine what type of door (e.g., California one piece orsectional) is to be moved, appropriately regulating the speed dependingupon this determination. Moreover, in the DC motor version, motorconfiguration bits can be programmed into the EEPROM 1016 at thefactory, indicating whether the unit is a belt, chain, or screw drivetype, or whether a “good”, “better”, or “best” performance is to berendered. During the motor operation, the software can then take thesefactors into consideration, upon power up, and automatically identifyand adjust the speed that the motor 1022 of that particular unit is tobe driven. The software can then monitor the output of theopto-interrupter 1020 (see FIG. 10) to assure that the actual speedmatches the goal speed; and if not, the software can adjust the PWM1010, and therefore the motor speed, accordingly.

As explained above, the software can control a DC motor through the useof PWM circuitry 1010. The different units: chain, belt, and screw asgood, better, and best, can provide different speeds for the homeowner.Examples of these speeds for a forty pound door are shown below in TABLE2 and TABLE 3, wherein opening and closing speeds respectively areprovided in inches per second.

TABLE 2 Chain Belt Screw Better Best Better Best Good Better Best 1(min) 5.5 5.5 5.5 5.5 5.5 5.5 5.5 2 6.25 7 6.25 7 7 8.5 8.5 3 (max) 78.5 7 8.5 10 10 12

TABLE 3 Chain Belt Screw Better Best Better Best Good Better Best 1(min) 5.5 5.5 5.5 5.5 5.5 5.5 5.5 2 6.25 7 6.25 7 7 7 7 3 (max) 7 8.5 78.5 7 8.5 8.5

When configuring the speed, a first LED can, for example, flash bluethree times, and then indicate the current setting, and whether theopening speed limit or closing speed limit is being set. The actualspeeds can depend on the good/better/best operator. In some instances,the DC units are capable of providing three speeds in the up directionand three speeds in the down direction, except for in the case of a goodscrew drive having an AC motor, in which case the AC motor only operatesat a single speed based on the load. In any case, a default speed (e.g.,five and five tenths inches per second) can be used when setting thelimits and determining the force profile.

In step 1916 (FIG. 19A), the user can set the speed limit by pressingthe up and down buttons until the desired value is reached, and thenpressing the program button again. At this point, a second LED can, forexample, flash blue three times as the first LED goes out. Then the usercan set the closing speed limit by pressing the up and down buttonsuntil the desired value is reached, and then pressing the program buttonagain. If the speed limit set is successful, both LEDs can, for example,light blue for two seconds, and then go out. Otherwise they can lightred in the same way to indicate an error.

Similarly, if the user's choice is determined at step 1920 to be achoice to set the barrier force sensitivity, then the force sensitivitythreshold adjustment choice can be obtained at step 1922, and a messagecan be queued at step 1924 for delivery over the expansion bus toindicate the chosen force adjustment. However, if the user's choice isdetermined at step 1926 (FIG. 19B) to be a learn remote procedure, thena KEELOQ® learn start procedure can be initiated at step 1930 in which aKEELOQ® remote is learned. During this procedure, if both the up anddown buttons are seen to be pressed and held down for a requisite periodof time (e.g., three seconds) then all of the barrier operator remotedevices 1038 (FIG. 10) stored in memory can be erased at step 1932, andthe KEELOQ® learn procedure can be exited at step 1934. In someembodiments, the erasure process at step 1932 can leave in memory remotecontrol devices that are accessories 1036 (see FIG. 10). Otherwise, ifthe up and down buttons are not held down, then a determination can bemade at step 1936 whether there is any reason to stop the learn remoteprocess at step 1934. For example, once a KEELOQ® remote is beinglearned, or in some embodiments, once a timeout condition is reached,then the KEELOQ® learn procedure can be exited at step 1934. At the endof any of the branches of this procedure, the LEDs 1040 can be operatedto indicate success or failure of the operator user interface task asdescribed above. A timeout can trigger a failure indication for allprocesses, while failure of the main microcontroller 1000 to acknowledgethe limits, force, and speed settings can similarly trigger a failureindication as described above.

Turning to FIG. 25, the barrier operator 20 can employ an INTELLICODE®II KEELOQ® encryption process mentioned above, and it can be employedinstead of, or in addition to, previous KEELOQ® encryption schemes(e.g., INTELLICODE® I). Table 4 shows an example of bit information forthis transmission, including a twenty-eight bit serial number 3000 (FIG.25), and a forty-four bit hopping code 3002 composed of a thirty-two bitKEELOQ® hopping code 3004 and a twelve bit secure signature 3006. Inthis example, the total number of data transmission bits adds up to atotal of seventy-two for one complete KEELOQ® code word 3008. Eachcodeword can contain both encrypted and unencrypted portions. The fixedcode, or unencrypted portion, can contain the twenty-eight bit deviceserial number 3000. The encrypted portion can contain a combination ofthe twelve bit secure signature 3006 and the thirty-two bit KEELOQ®hopping code 3004.

TABLE 4 INTELLICODE ® II 72-bit KEELOQ ® Packet Format Unencrypted (28bits) Encrypted (44 bits) Serial Number Secure Signature Func/Discr SyncCounter (28 bits) (12 bits) (8 bits) (24 bits)

Continuing with reference to FIG. 25, a thirty-two bit KEELOQ® hoppingcode data portion 3010 can be calculated using the traditional KEELOQ®thirty two bit block cipher encryption process 3012 that employs asixty-four bit Encryption Key (EKEY) 3014 and a thirty-two bit seed3016. Information contained within these first thirty-two bits can bethe twenty-four bit synchronization counter 3018, a four bit functioncode 3020, and a four bit user defined discrimination bits 3022. Thesixty-four bit EKEY 3014 used for each transmitter can be unique to thattransmitter. The EKEY 3014 can be derived from a sixty-four bitmanufacturer's code and the device's unique twenty-eight bit serialnumber. This sixty-four bit manufacturer's code can be changed regularlyover time for added security.

The number of bits for the KEELOQ® synchronization counter 3018 can beincreased from the previous sixteen bits to a new twenty-four bits toincrease the number of counter combinations from sixty-five thousand,five-hundred thirty-six to sixteen million, seven-hundred seventy-seventhousand, two-hundred sixteen. This huge increase in the number ofcounter values can assist in preventing selective transmission capturingtechniques. INTELLICODE® II transmitters can also be assigned a randomstarting counter value during production programming to better utilizethis large counter space. An eight bit function/discrimination code cancontain four bits of button information as well as four customerconfigurable constant bits. These bits can be used during KEELOQ® postdecryption validation checks, and also ultimately identify what buttonor function action is required.

The addition of twelve additional encrypted data transmission bits,called the secure signature bits 3024, can be performed to increase thelevel of security of the overall KEELOQ® code hopping system withoutswitching to another, more complicated encryption algorithm. Increasingthe security of the security system generally requires the use ofstronger encryption algorithms, the use of longer encryption keys ormultiple encryption keys/calculations, or a combination of thesemethods. By using more than one sixty-four bit encryption key within thesame system, any brute force type attack scheme needs to calculate morekey combinations to attack the security of the system.

All block cipher algorithms, such as the one used with KEELOQ®,typically works on a fixed block size, thirty-two bits for thetraditional KEELOQ® encryption algorithm, or one-hundred twenty-eightbits for AES. So, for example, to jump from one block cipher algorithm(e.g., KEELOQ®) to another (e.g., AES) requires a significant increasein the number of data bits that is needed, and this jump can alsosometimes complicate existing RF designs, perhaps even requiring aredesign or a reduction in the overall system performance.

Various algorithmic schemes can be employed to utilize these additionalsignature bits, ranging from a simple CRC checksum calculation to moresophisticated secure hashing algorithms, such as SHA-1. To reduce thenumber of additional data bits needed, the INTELLICODE® II system canutilize a sixteen bit CRC calculation 3026 that performs an XOR of theupper and lower sixteen bits of the thirty-two bit KEELOQ® hopping code3010 to obtain a sixteen bit CRC 3028. Then, instead of simply sendingthe result unencrypted, the encoder can obscure the result by using theKEELOQ® decryption process 3030, and a second sixty-four bit decryptionkey, called the signature key (SKEY) 3032. Intermingling of the uppertwenty bits 3034 of the thirty-two bit KEELOQ® code hopping code 3010with the twelve bit CRC 3024 to obtain a thirty-two bit seed 3036 forthe decryption process 3030 can be employed to produce the thirty-twobit KEELOQ® hopping code 3004 in order to further increase security, fornow two sixty-four bit keys need to be determined to allow the securitysystem to work. The secure signature 3006 can also be the lower twelvebits of the hopping code 3010. The SKEY 3032 can be the same for alldevices or unique to each device. Having them unique to each device canadd additional security to each transmitter.

The foregoing description is of exemplary and preferred embodiments of anew and improved remote controlled barrier operator system and themethods for operation of same. The invention is not limited to thedescribed examples or embodiments. Various alterations and modificationsto the disclosed embodiments may be made without departing from thespirit and scope of the appended claims.

1. A method for preventing thermal overload of a DC motor in a barrieroperator system, comprising: calculating a thermal effectivity parameterin accordance with (i) the time that the DC motor is running, and (ii)the extent of the load on the motor; determining if the thermaleffectivity parameter exceeds a predetermined value; and automaticallyinhibiting the operation of the motor when said thermal effectivityparameter exceeds said predetermined value.
 2. A thermally protectedbarrier operator system, comprising: a microcontroller, under control ofsoftware, operative to: (1) control operation of a DC motor to move abarrier; (2) perform calculation of force encountered by the barrier bymonitoring current supplied to the motor; (3) predict a thermalcondition of the motor by: (a) periodically incrementing a thermal loadvalue in response to: (i) the motor operating over time; and (ii) thecalculation of force encountered by the barrier; and (b) periodicallydecrementing the thermal load value in response to the motor notoperating over time; and (4) inhibit operation of the motor when thethermal load value exceeds a predetermined threshold.